Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in __release_resource

[Bradley Morgan]

#syz test: From 9cd23575828ada0a338a2dd0019e97476c4f5d23 Mon Sep 17
00:00:00 2001
From: Bradley Morgan <include@xxxxxxxxx>
Date: Sat, 1 Aug 2026 00:58:20 +0000
Subject: [PATCH] driver core: platform: use remove_resource() to properly reparent children

platform_device_add() inserts resources into the global iomem/ioport
trees via insert_resource(), which may reparent existing resources as
children of the newly inserted one.

The teardown paths in platform_device_add() (error path) and
platform_device_del() use release_resource() to remove these
resources.  However, release_resource() calls __release_resource()
with release_child=true, which simply unlinks the resource from its
parent's child list without reparenting its children.  Any child
resources that were moved under it by insert_resource() are left
with dangling ->parent pointers.

When the platform device's kmemdup'd resource array is subsequently
freed by platform_device_release(), those children (e.g. a PCI BAR
resource that was reparented under the platform device's resource)
end up with ->parent pointing to freed memory.  A later
release_resource() on such a child dereferences the stale pointer in
__release_resource(), causing a slab-use-after-free.

Fix it by using remove_resource() instead, which is the proper
counterpart to insert_resource().  remove_resource() calls
__release_resource() with release_child=false, which reparents
children up to the removed resource's parent before unlinking it,
keeping all ->parent pointers valid.

Reported-by: syzbot+ee1062851b628d722093@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://lore.kernel.org/all/6a6d39e7.f794c993.27aeb.0009.GAE@xxxxxxxxxx/
Assisted-by: GLM:glm-5.2
Signed-off-by: Bradley Morgan <include@xxxxxxxxx>
---
 drivers/base/platform.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index a71015f1d915..9a6932d50ee5 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -830,7 +830,7 @@ int platform_device_add(struct platform_device *pdev)
        while (i--) {
                struct resource *r = &pdev->resource[i];
                if (r->parent)
-                       release_resource(r);
+                       remove_resource(r);
        }

        return ret;
@@ -860,7 +860,7 @@ void platform_device_del(struct platform_device *pdev)
                for (i = 0; i < pdev->num_resources; i++) {
                        struct resource *r = &pdev->resource[i];
                        if (r->parent)
-                               release_resource(r);
+                               remove_resource(r);
                }
        }
 }
--
2.47.3


Note: AI generated.
Thanks!