Re: [PATCH v9 8/9] PCI: of: Set fwnode device of newly created PCI device nodes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The `fwnode->dev` pointer is not cleared in the error paths of `of_pci_make_dev_node()` and `of_pci_make_host_bridge_node()`, potentially leaving a dangling pointer.
--

--- Patch [8]: [PATCH v9 8/9] PCI: of: Set fwnode device of newly created PCI device nodes ---
commit deed8a4ace1f4465ff17d82fc17dc458281c89a1
Author: Herve Codina <herve.codina@bootlin.com>

PCI: of: Set fwnode device of newly created PCI device nodes

This commit sets the fwnode device field for dynamically created PCI
device nodes to prevent fw_devlink from incorrectly using the PCI root
bridge as a supplier. It ensures proper links are created by pointing
devlink directly to the PCI device.

> diff --git a/drivers/pci/of.c b/drivers/pci/of.c
> index 8dd558a490bbd..ca83006b7c7e2 100644
> --- a/drivers/pci/of.c
> +++ b/drivers/pci/of.c

[ ... ]

> @@ -709,6 +710,13 @@ void of_pci_make_dev_node(struct pci_dev *pdev)
>  	if (ret)
>  		goto out_free_node;
>  
> +	/*
> +	 * Set the fwnode device in order to have fw_devlink creating links
> +	 * pointing to this PCI device instead of walking up to the PCI host
> +	 * bridge.
> +	 */
> +	fw_devlink_set_device(&np->fwnode, &pdev->dev);
> +
>  	ret = of_changeset_apply(cset);
>  	if (ret)
>  		goto out_free_node;

[Severity: High]
If of_changeset_apply() fails here, the code jumps to the out_free_node
error path in of_pci_make_dev_node() without clearing the fwnode.dev
pointer that was just set.

If the node survives due to an external reference acquired during partial
application (such as from an OF_RECONFIG_ATTACH_NODE listener), could this
leave np->fwnode.dev pointing to &pdev->dev?

When the PCI device is later freed, does this result in a dangling pointer
and a potential use-after-free?

Should fw_devlink_set_device(&np->fwnode, NULL) be called in the error
handling path to safely undo the assignment?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708100302.517792-1-herve.codina@bootlin.com?part=8