]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
of: unittest: fix use-after-free in testdrv_probe()
authorWentao Liang <vulab@iscas.ac.cn>
Thu, 9 Apr 2026 03:48:59 +0000 (03:48 +0000)
committerRob Herring (Arm) <robh@kernel.org>
Thu, 16 Apr 2026 12:27:17 +0000 (07:27 -0500)
commit07fd339b2c253205794bea5d9b4b7548a4546c56
tree4c9d0faca59afa7b2a1b06f6cdbf12a73cf7359d
parentfaecdd423c27f0d6090156a435ba9dbbac0eaddb
of: unittest: fix use-after-free in testdrv_probe()

The function testdrv_probe() retrieves the device_node from the PCI
device, applies an overlay, and then immediately calls of_node_put(dn).
This releases the reference held by the PCI core, potentially freeing
the node if the reference count drops to zero. Later, the same freed
pointer 'dn' is passed to of_platform_default_populate(), leading to a
use-after-free.

The reference to pdev->dev.of_node is owned by the device model and
should not be released by the driver. Remove the erroneous of_node_put()
to prevent premature freeing.

Fixes: 26409dd04589 ("of: unittest: Add pci_dt_testdrv pci driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260409034859.429071-1-vulab@iscas.ac.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
drivers/of/unittest.c