Re: [PATCH v11 07/10] PCI: of: Clear fwnode->dev during root bridge node removal and error path

[Bartosz Golaszewski]

On Wed, 9 Sep 2026 10:01:06 +0200, Herve Codina <herve.codina@xxxxxxxxxxx> said:
> During the of_pci_make_host_bridge_node() call, an OF node is created
> dynamically and its fwnode device (fwnode->dev) is set to the PCI root
> bridge device using the fw_devlink_set_device(&np->fwnode, &bridge->dev)
> call.
>
> On removal, of_pci_remove_host_bridge_node() is called and calls
> device_remove_of_node() which in turn set to NULL the related
> dev->fwnode.
>
> Later in the removal sequence, device_del() is called and runs its
> cleanup logic:
>
>     if (dev->fwnode && dev->fwnode->dev == dev)
>         fw_devlink_set_device(dev->fwnode, NULL);
>
> Because dev->fwnode has been cleared earlier, fw_devlink_set_device()
> is not called and leaves fwnode->dev unchanged. This fwnode device
> (fwnode->dev) becomes an dangling pointer.
>
> If any reference to the OF node is held after this removal, the pointer
> is still accessible using the OF node (np->fwnode.dev) but points to a
> freed area.
>
> The exact same issue is present in the of_pci_make_host_bridge_node()
> error path leading to the exact same dangling fwnode->dev.
>
> Avoid this dangling fwnode->dev pointer by clearing it in
> of_pci_remove_host_bridge_node() and in of_pci_make_host_bridge_node()
> error path.
>
> Fixes: 1f340724419e ("PCI: of: Create device tree PCI host bridge node")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Herve Codina <herve.codina@xxxxxxxxxxx>
> Reviewed-by: Richard Cheng <icheng@xxxxxxxxxx>
> Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@xxxxxxxxxxxxxxxx>
> ---

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxxxxxxxx>