* [PATCH] interconnect: imx: fix use-after-free in imx_icc_node_init_qos()
@ 2026-04-08 3:10 Wentao Liang
2026-04-08 7:24 ` Frank Li
2026-04-08 7:28 ` Markus Elfring
0 siblings, 2 replies; 3+ messages in thread
From: Wentao Liang @ 2026-04-08 3:10 UTC (permalink / raw)
To: Georgi Djakov, Shawn Guo, Sascha Hauer
Cc: Pengutronix Kernel Team, Fabio Estevam, linux-pm, imx,
linux-arm-kernel, linux-kernel, Wentao Liang, stable
Move of_node_put(dn) after the last use of dn, and add a missing put
in the error path to avoid both use-after-free and reference leak.
Fixes: f0d8048525d7 ("interconnect: Add imx core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/interconnect/imx/imx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/interconnect/imx/imx.c b/drivers/interconnect/imx/imx.c
index 9511f80cf041..75431b5ccef8 100644
--- a/drivers/interconnect/imx/imx.c
+++ b/drivers/interconnect/imx/imx.c
@@ -143,15 +143,16 @@ static int imx_icc_node_init_qos(struct icc_provider *provider,
}
pdev = of_find_device_by_node(dn);
- of_node_put(dn);
if (!pdev) {
dev_warn(dev, "node %s[%d] missing device for %pOF\n",
node->name, node->id, dn);
+ of_node_put(dn);
return -EPROBE_DEFER;
}
node_data->qos_dev = &pdev->dev;
dev_dbg(dev, "node %s[%d] has device node %pOF\n",
node->name, node->id, dn);
+ of_node_put(dn);
}
return dev_pm_qos_add_request(node_data->qos_dev,
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] interconnect: imx: fix use-after-free in imx_icc_node_init_qos()
2026-04-08 3:10 [PATCH] interconnect: imx: fix use-after-free in imx_icc_node_init_qos() Wentao Liang
@ 2026-04-08 7:24 ` Frank Li
2026-04-08 7:28 ` Markus Elfring
1 sibling, 0 replies; 3+ messages in thread
From: Frank Li @ 2026-04-08 7:24 UTC (permalink / raw)
To: Wentao Liang
Cc: Georgi Djakov, Shawn Guo, Sascha Hauer, Pengutronix Kernel Team,
Fabio Estevam, linux-pm, imx, linux-arm-kernel, linux-kernel,
stable
On Wed, Apr 08, 2026 at 03:10:04AM +0000, Wentao Liang wrote:
> Move of_node_put(dn) after the last use of dn, and add a missing put
> in the error path to avoid both use-after-free and reference leak.
>
> Fixes: f0d8048525d7 ("interconnect: Add imx core driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
> drivers/interconnect/imx/imx.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/interconnect/imx/imx.c b/drivers/interconnect/imx/imx.c
> index 9511f80cf041..75431b5ccef8 100644
> --- a/drivers/interconnect/imx/imx.c
> +++ b/drivers/interconnect/imx/imx.c
> @@ -143,15 +143,16 @@ static int imx_icc_node_init_qos(struct icc_provider *provider,
> }
>
Please use auto cleanup to fix this problem
struct device_node * __free(device_nod) dn = of_parse_phandle(dev->of_node, adj->phandle_name, 0);
Frank
> pdev = of_find_device_by_node(dn);
> - of_node_put(dn);
> if (!pdev) {
> dev_warn(dev, "node %s[%d] missing device for %pOF\n",
> node->name, node->id, dn);
> + of_node_put(dn);
> return -EPROBE_DEFER;
> }
> node_data->qos_dev = &pdev->dev;
> dev_dbg(dev, "node %s[%d] has device node %pOF\n",
> node->name, node->id, dn);
> + of_node_put(dn);
> }
>
> return dev_pm_qos_add_request(node_data->qos_dev,
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] interconnect: imx: fix use-after-free in imx_icc_node_init_qos()
2026-04-08 3:10 [PATCH] interconnect: imx: fix use-after-free in imx_icc_node_init_qos() Wentao Liang
2026-04-08 7:24 ` Frank Li
@ 2026-04-08 7:28 ` Markus Elfring
1 sibling, 0 replies; 3+ messages in thread
From: Markus Elfring @ 2026-04-08 7:28 UTC (permalink / raw)
To: vulab, imx, linux-pm, linux-arm-kernel, Georgi Djakov,
Sascha Hauer, Shawn Guo
Cc: kernel, stable, LKML, Fabio Estevam
> Move of_node_put(dn) after the last use of dn, and add a missing put
> in the error path to avoid both use-after-free and reference leak.
How do you think about to increase the application of scope-based resource management?
https://elixir.bootlin.com/linux/v7.0-rc7/source/include/linux/of.h#L138
https://elixir.bootlin.com/linux/v7.0-rc7/source/drivers/interconnect/imx/imx.c#L117-L160
Regards,
Markus
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-08 7:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-08 3:10 [PATCH] interconnect: imx: fix use-after-free in imx_icc_node_init_qos() Wentao Liang
2026-04-08 7:24 ` Frank Li
2026-04-08 7:28 ` Markus Elfring
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox