Re: [PATCH v10 07/10] PCI: of: Clear fwnode->dev during root bridge node removal and error path

[Manivannan Sadhasivam]

On Fri, Jul 17, 2026 at 04:51:42PM +0200, Herve Codina wrote:
> During the of_pci_make_host_bridge_node() call, an OF node is created
> dynamically and its fwnode device (fwnode->dev) is set to the PCI root
> bridge device using the fw_devlink_set_device(&np->fwnode, &bridge->dev)
> call.
> 
> On removal, of_pci_remove_host_bridge_node() is called and calls
> device_remove_of_node() which in turn set to NULL the related
> dev->fwnode.
> 
> Later in the removal sequence, device_del() is called and runs its
> cleanup logic:
> 
>     if (dev->fwnode && dev->fwnode->dev == dev)
>         fw_devlink_set_device(dev->fwnode, NULL);
> 
> Because dev->fwnode has been cleared earlier, fw_devlink_set_device()
> is not called and leaves fwnode->dev unchanged. This fwnode device
> (fwnode->dev) becomes an dangling pointer.
> 
> If any reference to the OF node is held after this removal, the pointer
> is still accessible using the OF node (np->fwnode.dev) but points to a
> freed area.
> 
> The exact same issue is present in the of_pci_make_host_bridge_node()
> error path leading to the exact same dangling fwnode->dev.
> 
> Avoid this dangling fwnode->dev pointer by clearing it in
> of_pci_remove_host_bridge_node() and in of_pci_make_host_bridge_node()
> error path.
> 
> Fixes: 1f340724419e ("PCI: of: Create device tree PCI host bridge node")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Herve Codina <herve.codina@xxxxxxxxxxx>

Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@xxxxxxxxxxxxxxxx>

- Mani

-- 
மணிவண்ணன் சதாசிவம்