Re: [PATCH v3] pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()

[Bartosz Golaszewski]

On Tue, 16 Jun 2026 15:10:49 +0000, Wentao Liang wrote:
> pwrseq_debugfs_seq_next() declares 'next' with __free(put_device),
> which causes put_device() to be called on the returned pointer when
> the variable goes out of scope.  This results in a use-after-free
> since the seq_file framework receives a pointer whose reference has
> already been dropped.
> 
> Simply removing __free(put_device) would fix the UAF but would leak
> the reference acquired by bus_find_next_device(), as stop() only
> calls up_read(&pwrseq_sem) and never releases the device reference.
> 
> [...]

Applied, thanks!

[1/1] pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
      https://git.kernel.org/brgl/c/257595adf9dac15ae1edd9d07753fbc576a7583d

Best regards,
-- 
Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxxxxxxxx>