Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in __release_resource

[syzbot <syzbot+ee1062851b628d722093@syzkaller.appspotmail.com>]

> #syz test: From 9cd23575828ada0a338a2dd0019e97476c4f5d23 Mon Sep 17

I've failed to parse your command.
Did you perhaps forget to provide the branch name, or added an extra ':'?
Please use one of the two supported formats:
1. #syz test
2. #syz test: repo branch-or-commit-hash
Note the lack of ':' in option 1.

> 00:00:00 2001
> From: Bradley Morgan <include@grrlz.net>
> Date: Sat, 1 Aug 2026 00:58:20 +0000
> Subject: [PATCH] driver core: platform: use remove_resource() to properly reparent children
>
> platform_device_add() inserts resources into the global iomem/ioport
> trees via insert_resource(), which may reparent existing resources as
> children of the newly inserted one.
>
> The teardown paths in platform_device_add() (error path) and
> platform_device_del() use release_resource() to remove these
> resources.  However, release_resource() calls __release_resource()
> with release_child=true, which simply unlinks the resource from its
> parent's child list without reparenting its children.  Any child
> resources that were moved under it by insert_resource() are left
> with dangling ->parent pointers.
>
> When the platform device's kmemdup'd resource array is subsequently
> freed by platform_device_release(), those children (e.g. a PCI BAR
> resource that was reparented under the platform device's resource)
> end up with ->parent pointing to freed memory.  A later
> release_resource() on such a child dereferences the stale pointer in
> __release_resource(), causing a slab-use-after-free.
>
> Fix it by using remove_resource() instead, which is the proper
> counterpart to insert_resource().  remove_resource() calls
> __release_resource() with release_child=false, which reparents
> children up to the removed resource's parent before unlinking it,
> keeping all ->parent pointers valid.
>
> Reported-by: syzbot+ee1062851b628d722093@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/6a6d39e7.f794c993.27aeb.0009.GAE@google.com/
> Assisted-by: GLM:glm-5.2
> Signed-off-by: Bradley Morgan <include@grrlz.net>
> ---
>  drivers/base/platform.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
> index a71015f1d915..9a6932d50ee5 100644
> --- a/drivers/base/platform.c
> +++ b/drivers/base/platform.c
> @@ -830,7 +830,7 @@ int platform_device_add(struct platform_device *pdev)
>         while (i--) {
>                 struct resource *r = &pdev->resource[i];
>                 if (r->parent)
> -                       release_resource(r);
> +                       remove_resource(r);
>         }
>
>         return ret;
> @@ -860,7 +860,7 @@ void platform_device_del(struct platform_device *pdev)
>                 for (i = 0; i < pdev->num_resources; i++) {
>                         struct resource *r = &pdev->resource[i];
>                         if (r->parent)
> -                               release_resource(r);
> +                               remove_resource(r);
>                 }
>         }
>  }
> --
> 2.47.3
>
>
> Note: AI generated.
> Thanks!