From: Markus Elfring <Markus.Elfring@web.de>
To: Frank Li <Frank.Li@nxp.com>,
vulab@iscas.ac.cn, imx@lists.linux.dev, kernel@pengutronix.de,
linux-arm-kernel@lists.infradead.org, linux-pm@vger.kernel.org
Cc: stable@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
Fabio Estevam <festevam@gmail.com>,
Georgi Djakov <djakov@kernel.org>,
Sascha Hauer <s.hauer@pengutronix.de>,
Shawn Guo <shawnguo@kernel.org>
Subject: Re: [v2] interconnect: imx: fix use-after-free in imx_icc_node_init_qos()
Date: Sun, 26 Apr 2026 09:20:30 +0200 [thread overview]
Message-ID: <0d7be98e-ab66-46ab-a729-b344500356a6@web.de> (raw)
In-Reply-To: <adceUA7PkOLjgyOt@lizhi-Precision-Tower-5810>
…
> > use dn after the put, leading to use-after-free. Convert to automatic
> > cleanup using __free(device_node) to ensure the reference is always
> > released when dn goes out of scope.
…
> Reviewed-by: Frank Li <Frank.Li@nxp.com>
> > drivers/interconnect/imx/imx.c | 6 ++----
…
> @@ -120,7 +120,8 @@ static int imx_icc_node_init_qos(struct icc_provider *provider,
> struct imx_icc_node *node_data = node->data;
> const struct imx_icc_node_adj_desc *adj = node_data->desc->adj;
> struct device *dev = provider->dev;
> - struct device_node *dn = NULL;
> + struct device_node *__free(device_nod) dn = of_parse_phandle(dev->of_node,
> + adj->phandle_name, 0);
…
A typo was overlooked somehow.
Regards,
Markus
next prev parent reply other threads:[~2026-04-26 7:21 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-08 15:30 [PATCH v2] interconnect: imx: fix use-after-free in imx_icc_node_init_qos() Wentao Liang
2026-04-09 3:34 ` Frank Li
2026-04-26 7:20 ` Markus Elfring [this message]
2026-04-26 5:31 ` kernel test robot
2026-04-26 14:19 ` kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0d7be98e-ab66-46ab-a729-b344500356a6@web.de \
--to=markus.elfring@web.de \
--cc=Frank.Li@nxp.com \
--cc=djakov@kernel.org \
--cc=festevam@gmail.com \
--cc=imx@lists.linux.dev \
--cc=kernel@pengutronix.de \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=s.hauer@pengutronix.de \
--cc=shawnguo@kernel.org \
--cc=stable@vger.kernel.org \
--cc=vulab@iscas.ac.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox