Re: [PATCH v2 2/8] i2c: core: fix swnode use-after-free on client deregistration

[Johan Hovold]

On Tue, Nov 10, 2026 at 12:58:15PM +0200, Andy Shevchenko wrote:
> On Tue, Nov 10, 2026 at 09:51:18AM +0100, Johan Hovold wrote:
> > If a client has both a primary and a secondary firmware node, the
> > secondary node is accessed via the ->secondary pointer of the primary
> > node.
> > 
> > Use a temporary variable to track whether the firmware node is a
> > software node and remove any software node before dropping its reference
> > to avoid a use-after-free in device_remove_software_node() when
> > accessing the secondary firmware node.
> 
> ...
> 
> > Fixes: df6d7277e552 ("i2c: core: Do not dereference fwnode in struct device")
> > Fixes: 1c24e5fc0c70 ("i2c: core: Fix double-free of fwnode in i2c_unregister_device()")
> > Cc: stable@xxxxxxxxxxxxxxx	# 6.16
> 
> > Cc: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
> > Cc: Hans de Goede <hansg@xxxxxxxxxx>
> 
> Can we keep these two Cc out of the commit message?

I prefer to highlight the authors of the commits mentioned in the Fixes
tag this way.

> > Signed-off-by: Johan Hovold <johan@xxxxxxxxxx>
> > ---

> > @@ -1066,14 +1067,14 @@ void i2c_unregister_device(struct i2c_client *client)
> >  	else if (is_acpi_device_node(fwnode))
> >  		acpi_device_clear_enumerated(to_acpi_device_node(fwnode));
> >  
> > +	fwnode_is_software_node = is_software_node(fwnode);
> > +	device_remove_software_node(&client->dev);
> >  	/*
> > -	 * If the primary fwnode is a software node it is free-ed by
> > -	 * device_remove_software_node() below, avoid double-free.
> > +	 * If the firmware node is a software node, its reference count
> > +	 * was decremented by device_remove_software_node().
> >  	 */
> > -	if (!is_software_node(fwnode))
> > +	if (!fwnode_is_software_node)
> >  		fwnode_handle_put(fwnode);
> 
> Do I understand correctly that this is a dup with the platform device case? Can
> we make a helper (on swnode API level) to cover any other existing or potential
> case to avoid similar issues in the future?

The bug is different, but the fix is the same. This all gets cleaned up
in patch 4/8.

Johan