Re: [PATCH] ACPI: PCI: link: clear driver_data before free

[Rafael J. Wysocki (Intel)]

On Fri, Sep 25, 2026 at 5:59 PM Jiale Yao <yaojiale02@xxxxxxx> wrote:
>
> acpi_pci_link_remove() frees the link object without clearing the ACPI
> device's driver_data pointer. The ACPI device survives hot-removal and
> can later be retrieved by acpi_fetch_acpi_dev(), leaving callers with a
> dangling pointer.
>
> Clear driver_data before freeing the link.
>
> Fixes: db89b4f0dbab ("ACPI: catch calls of acpi_driver_data on pointer of wrong type")
> Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
> ---
>  drivers/acpi/pci_link.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
> index e6ed13aee48d..84bfcdf242dd 100644
> --- a/drivers/acpi/pci_link.c
> +++ b/drivers/acpi/pci_link.c
> @@ -787,6 +787,7 @@ static void acpi_pci_link_remove(struct acpi_device *device)
>         list_del(&link->list);
>         mutex_unlock(&acpi_link_lock);
>
> +       device->driver_data = NULL;
>         kfree(link);
>  }
>
> --

Applied as 7.4 material, thanks!