Re: [PATCH 1/2] driver core: platform: fix sw node use-after-free on device release

[Bartosz Golaszewski]

On Mon, Nov 02, 2026 at 12:14:19PM +0100, Johan Hovold wrote:
> When a device has a software node, device_remove_software_node() may
> drop the last reference and free it during platform_device_release().
> And if the software node is the primary node then the device fwnode
> pointer is currently never cleared.
> 
> Use a temporary variable to track whether the primary node is a software
> node to avoid a use-after-free in is_software_node() and having
> fwnode_handle_put() call a function pointer via poisoned or reallocated
> memory when the primary node is a software node.
> 
> This issue was flagged by Sashiko when reviewing a related fix.
> 
> Fixes: 7d80509ff0da ("driver core: platform: unify release path")
> Closes: https://sashiko.dev/#/bug/linux-b860000b-f1d0-46a0-ab52-d47cec8eab99
> Cc: stable@xxxxxxxxxxxxxxx	# 7.3
> Cc: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxxxxxxxx>
> Signed-off-by: Johan Hovold <johan@xxxxxxxxxx>
> ---

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxxxxxxxx>