* [PATCH 1/2] driver core: platform: fix sw node use-after-free on device release
[not found] <20261102111420.1330760-1-johan@kernel.org>
@ 2026-11-02 11:14 ` Johan Hovold
2026-11-02 13:48 ` Bartosz Golaszewski
2026-11-02 11:14 ` [PATCH 2/2] software node: fix primary software node removal Johan Hovold
1 sibling, 1 reply; 4+ messages in thread
From: Johan Hovold @ 2026-11-02 11:14 UTC (permalink / raw)
To: Greg Kroah-Hartman, Rafael J. Wysocki, Danilo Krummrich,
Johan Hovold
Cc: Andy Shevchenko, Daniel Scally, Heikki Krogerus, Sakari Ailus,
Bartosz Golaszewski, driver-core, linux-acpi, linux-kernel,
stable, Bartosz Golaszewski
When a device has a software node, device_remove_software_node() may
drop the last reference and free it during platform_device_release().
And if the software node is the primary node then the device fwnode
pointer is currently never cleared.
Use a temporary variable to track whether the primary node is a software
node to avoid a use-after-free in is_software_node() and having
fwnode_handle_put() call a function pointer via poisoned or reallocated
memory when the primary node is a software node.
This issue was flagged by Sashiko when reviewing a related fix.
Fixes: 7d80509ff0da ("driver core: platform: unify release path")
Closes: https://sashiko.dev/#/bug/linux-b860000b-f1d0-46a0-ab52-d47cec8eab99
Cc: stable@vger.kernel.org # 7.3
Cc: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/base/platform.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 979593e5cca1..ef0bfa972653 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -598,13 +598,14 @@ static void platform_device_release(struct device *dev)
{
struct platform_object *pa = container_of(dev, struct platform_object,
pdev.dev);
+ bool primary_is_software_node = is_software_node(dev_fwnode(dev));
device_remove_software_node(dev);
/*
* If the primary firmware node is a software node, its reference count
* was already decreased by the call to device_remove_software_node().
*/
- if (!is_software_node(dev_fwnode(dev)))
+ if (!primary_is_software_node)
fwnode_handle_put(pa->pdev.dev.fwnode);
kfree(pa->pdev.dev.platform_data);
kfree(pa->pdev.mfd_cell);
--
2.55.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH 2/2] software node: fix primary software node removal
[not found] <20261102111420.1330760-1-johan@kernel.org>
2026-11-02 11:14 ` [PATCH 1/2] driver core: platform: fix sw node use-after-free on device release Johan Hovold
@ 2026-11-02 11:14 ` Johan Hovold
2026-11-02 16:34 ` Johan Hovold
1 sibling, 1 reply; 4+ messages in thread
From: Johan Hovold @ 2026-11-02 11:14 UTC (permalink / raw)
To: Greg Kroah-Hartman, Rafael J. Wysocki, Danilo Krummrich,
Johan Hovold
Cc: Andy Shevchenko, Daniel Scally, Heikki Krogerus, Sakari Ailus,
Bartosz Golaszewski, driver-core, linux-acpi, linux-kernel,
stable, Bartosz Golaszewski
When removing a software node using device_remove_software_node(), the
primary fwnode pointer is never cleared if the software node is the
primary node.
Since commit 7d80509ff0da ("driver core: platform: unify release path")
this can lead to a use-after-free when freeing a platform device if a
driver or subsystem (e.g. mfd) has already removed and freed the node.
Clear the primary fwnode pointer when removing a software node that is
the primary node to avoid this.
Fixes: 7d80509ff0da ("driver core: platform: unify release path")
Cc: stable@vger.kernel.org # 7.3
Cc: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/base/swnode.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index 84a77ffa3dc4..9c98234979ec 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -1110,7 +1110,11 @@ void device_remove_software_node(struct device *dev)
if (device_is_registered(dev))
software_node_notify_remove(dev);
- set_secondary_fwnode(dev, NULL);
+ if (is_software_node(dev_fwnode(dev)))
+ set_primary_fwnode(dev, NULL);
+ else
+ set_secondary_fwnode(dev, NULL);
+
swnode_put(swnode);
}
EXPORT_SYMBOL_GPL(device_remove_software_node);
--
2.55.0
^ permalink raw reply related [flat|nested] 4+ messages in thread