From: Andy Shevchenko <andriy.shevchenko@intel.com>
To: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Cc: jic23@kernel.org, sboyd@kernel.org, dlechner@baylibre.com,
nuno.sa@analog.com, andy@kernel.org, arnd@arndb.de,
gregkh@linuxfoundation.org, srini@kernel.org, vkoul@kernel.org,
neil.armstrong@linaro.org, sre@kernel.org, krzk@kernel.org,
dmitry.baryshkov@oss.qualcomm.com, quic_wcheng@quicinc.com,
melody.olvera@oss.qualcomm.com, quic_nsekar@quicinc.com,
ivo.ivanov.ivanov1@gmail.com, abelvesa@kernel.org,
luca.weiss@fairphone.com, konrad.dybcio@oss.qualcomm.com,
mitltlatltl@gmail.com, krishna.kurapati@oss.qualcomm.com,
linux-arm-msm@vger.kernel.org, linux-iio@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-phy@lists.infradead.org,
linux-pm@vger.kernel.org, kernel@collabora.com,
stable@vger.kernel.org, Sashiko Bot <sashiko-bot@kernel.org>
Subject: Re: [PATCH v10 01/11] spmi: Fix potential use-after-free by grabbing of_node reference
Date: Tue, 7 Jul 2026 12:07:00 +0300 [thread overview]
Message-ID: <akzBtOjs0Blb1pnF@ashevche-desk.local> (raw)
In-Reply-To: <20260707083730.33977-2-angelogioacchino.delregno@collabora.com>
On Tue, Jul 07, 2026 at 10:37:20AM +0200, AngeloGioacchino Del Regno wrote:
> As noticed by Sashiko during a review run of an unrelated patch,
> in of_spmi_register_devices(), for_each_available_child_of_node()
> is used to loop through children, and to also assign a node to a
> newly created SPMI child device.
>
> Problem is that the refcount is dropped at every iteration so, in
> the specific case of DT overlays, a use-after-free may occur when
> an overlay is dynamically unloaded!
>
> To resolve this, increase the of_node refcount when assigning (in
> function of_spmi_register_devices) and release the reference in
> spmi_device_remove().
...
> void spmi_device_remove(struct spmi_device *sdev)
> {
> + if (IS_ENABLED(CONFIG_OF))
Unneeded check.
> + of_node_put(sdev->dev.of_node);
> +
> device_unregister(&sdev->dev);
> }
--
With Best Regards,
Andy Shevchenko
next prev parent reply other threads:[~2026-07-07 9:07 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-07 8:37 [PATCH v10 00/11] SPMI: Implement sub-devices and migrate drivers AngeloGioacchino Del Regno
2026-07-07 8:37 ` [PATCH v10 01/11] spmi: Fix potential use-after-free by grabbing of_node reference AngeloGioacchino Del Regno
2026-07-07 9:07 ` Andy Shevchenko [this message]
2026-07-07 8:37 ` [PATCH v10 02/11] spmi: Remove redundant dev_name() print in spmi_device_add() AngeloGioacchino Del Regno
2026-07-07 8:37 ` [PATCH v10 03/11] spmi: Print error status with %pe format AngeloGioacchino Del Regno
2026-07-07 8:37 ` [PATCH v10 04/11] spmi: Remove unneeded goto in spmi_device_add() error path AngeloGioacchino Del Regno
2026-07-07 8:37 ` [PATCH v10 05/11] spmi: Implement spmi_subdevice_alloc_and_add() and devm variant AngeloGioacchino Del Regno
2026-07-07 8:37 ` [PATCH v10 06/11] nvmem: qcom-spmi-sdam: Migrate to devm_spmi_subdevice_alloc_and_add() AngeloGioacchino Del Regno
2026-07-07 8:37 ` [PATCH v10 07/11] power: reset: qcom-pon: " AngeloGioacchino Del Regno
2026-07-07 8:37 ` [PATCH v10 08/11] phy: qualcomm: eusb2-repeater: " AngeloGioacchino Del Regno
2026-07-07 8:37 ` [PATCH v10 09/11] misc: qcom-coincell: " AngeloGioacchino Del Regno
2026-07-07 8:37 ` [PATCH v10 10/11] iio: adc: qcom-spmi-iadc: " AngeloGioacchino Del Regno
2026-07-07 8:37 ` [PATCH v10 11/11] iio: adc: qcom-spmi-iadc: Remove regmap R/W wrapper functions AngeloGioacchino Del Regno
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=akzBtOjs0Blb1pnF@ashevche-desk.local \
--to=andriy.shevchenko@intel.com \
--cc=abelvesa@kernel.org \
--cc=andy@kernel.org \
--cc=angelogioacchino.delregno@collabora.com \
--cc=arnd@arndb.de \
--cc=dlechner@baylibre.com \
--cc=dmitry.baryshkov@oss.qualcomm.com \
--cc=gregkh@linuxfoundation.org \
--cc=ivo.ivanov.ivanov1@gmail.com \
--cc=jic23@kernel.org \
--cc=kernel@collabora.com \
--cc=konrad.dybcio@oss.qualcomm.com \
--cc=krishna.kurapati@oss.qualcomm.com \
--cc=krzk@kernel.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-phy@lists.infradead.org \
--cc=linux-pm@vger.kernel.org \
--cc=luca.weiss@fairphone.com \
--cc=melody.olvera@oss.qualcomm.com \
--cc=mitltlatltl@gmail.com \
--cc=neil.armstrong@linaro.org \
--cc=nuno.sa@analog.com \
--cc=quic_nsekar@quicinc.com \
--cc=quic_wcheng@quicinc.com \
--cc=sashiko-bot@kernel.org \
--cc=sboyd@kernel.org \
--cc=sre@kernel.org \
--cc=srini@kernel.org \
--cc=stable@vger.kernel.org \
--cc=vkoul@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox