Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Dereferencing a freed primary software node during platform device release, leading to a Use-After-Free and possible double-put. --
--- Patch [4]: [PATCH v8 4/5] driver core: platform: unify release path --- commit a4c9de720c7986b23ccb07ee951d4a99f15666ec Author: Bartosz Golaszewski <[email protected]> driver core: platform: unify release path With no drivers that manually assign software nodes to platform devices created with platform_device_alloc(), we can now unify the release path and remove platform_device_release_full(). > diff --git a/drivers/base/platform.c b/drivers/base/platform.c > index fb57d487a6c2a..66f9ec73d47e9 100644 > --- a/drivers/base/platform.c > +++ b/drivers/base/platform.c [ ... ] > @@ -599,19 +599,19 @@ static void platform_device_release(struct device *dev) > struct platform_object *pa = container_of(dev, struct platform_object, > pdev.dev); > > - fwnode_handle_put(pa->pdev.dev.fwnode); > + device_remove_software_node(dev); > + /* > + * If the primary firmware node is a software node, its reference count > + * was already decreased by the call to device_remove_software_node(). > + */ > + if (!is_software_node(dev_fwnode(dev))) [Severity: High] Does this check result in a use-after-free of the primary software node? If a platform device is registered with a primary software node (for example via platform_device_register_full()), dev->fwnode points to it. During device release, device_remove_software_node() retrieves the primary software node and drops the reference, potentially freeing the node: device_remove_software_node() swnode_put(swnode); Because dev->fwnode is primary, set_secondary_fwnode(dev, NULL) inside device_remove_software_node() only clears the secondary pointer, leaving dev->fwnode still pointing to the freed primary node. The subsequent call to is_software_node(dev_fwnode(dev)) would then dereference this dangling pointer. > + fwnode_handle_put(pa->pdev.dev.fwnode); > kfree(pa->pdev.dev.platform_data); > kfree(pa->pdev.mfd_cell); > kfree(pa->pdev.resource); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20260716-swnode-remove-on-dev-unreg-v8-0-5c2b8cc38...@oss.qualcomm.com?part=4
