Re: [PATCH v11 03/12] spmi: Print error status with %pe format

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Double free of the OF node reference on the error path in of_spmi_register_devices(), causing a use-after-free when the iterator advances.
--

--- Patch [3]: [PATCH v11 03/12] spmi: Print error status with %pe format ---
commit cc57872e8fd24ed8583906bc26b0396c30834b44
Author: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>

spmi: Print error status with %pe format

Instead of printing just a number, use the %pe format for error
status, increasing readability of error prints.

> diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c
> index 9bee0cb3d9dc1..2cf5fd5e1ba90 100644
> --- a/drivers/spmi/spmi.c
> +++ b/drivers/spmi/spmi.c
[ ... ]
> @@ -525,7 +525,7 @@ static void of_spmi_register_devices(struct spmi_controller *ctrl)
>  		err = spmi_device_add(sdev);
>  		if (err) {
>  			dev_err(&sdev->dev,
> -				"failure adding device. status %d\n", err);
> +				"failure adding device. status %pe\n", ERR_PTR(err));
>  			of_node_put(node);
>  			spmi_device_put(sdev);
>  		}

[Severity: Critical]
Does this error path double-free the OF node reference?

If spmi_device_add() fails during device registration in
of_spmi_register_devices(), the error path explicitly calls of_node_put(node).
However, it also calls spmi_device_put(sdev), which invokes spmi_dev_release()
and drops the same of_node reference again:

drivers/spmi/spmi.c:spmi_dev_release() {
	...
	if (IS_ENABLED(CONFIG_OF))
		of_node_put(dev->of_node);
	...
}

When the for_each_available_child_of_node() loop advances, the iterator macro
will drop the reference a third time, but it was only acquired twice (once by
the macro, once by of_node_get()). This can cause a reference count underflow
and a use-after-free.

This regression was introduced in the first patch of this series.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707101821.173319-1-angelogioacchino.delregno@collabora.com?part=3

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy