On Mon, 26 Jan 2026 11:41:37 +0100, Ahmad Fatoum wrote:
> devfs_remove acces struct cdev::name to do an unlink on the path in
> /dev. This leads to a use-after-free inside mdio_bus_remove.
>
> Reorder the free after devfs_remove to fix this. This is the way that
> other drivers in tree that have /free.*cdev(\.|->)name/ do it.
>
> Issue was detected by KASAN being active during kernel boot.
>
> [...]
Applied, thanks!
[1/1] net: phy: mdio_bus: fix freeing of cdev name before devfs_remove
https://git.pengutronix.de/cgit/barebox/commit/?id=0a67f4f35d64 (link may
not be stable)
Best regards,
--
Sascha Hauer <[email protected]>
