Wentao Liang d68347b07b of: unittest: fix use-after-free in testdrv_probe() ...

commit 07fd339b2c upstream.

The function testdrv_probe() retrieves the device_node from the PCI
device, applies an overlay, and then immediately calls of_node_put(dn).
This releases the reference held by the PCI core, potentially freeing
the node if the reference count drops to zero. Later, the same freed
pointer 'dn' is passed to of_platform_default_populate(), leading to a
use-after-free.

The reference to pdev->dev.of_node is owned by the device model and
should not be released by the driver. Remove the erroneous of_node_put()
to prevent premature freeing.

Fixes: 26409dd045 ("of: unittest: Add pci_dt_testdrv pci driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260409034859.429071-1-vulab@iscas.ac.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-05-07 06:09:27 +02:00

..

unittest-data

…

.kunitconfig

…

address.c

…

base.c

device property: Make modifications of fwnode "flags" thread safe

2026-05-07 06:09:26 +02:00

cpu.c

…

device.c

…

dynamic.c

device property: Make modifications of fwnode "flags" thread safe

2026-05-07 06:09:26 +02:00

empty_root.dts

…

fdt_address.c

…

fdt.c

…

irq.c

…

Kconfig

…

kexec.c

of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()

2026-03-13 17:20:27 +01:00

kobj.c

…

kunit_overlay_test.dtso

…

Makefile

…

module.c

…

of_kunit_helpers.c

…

of_numa.c

…

of_private.h

…

of_reserved_mem.c

…

of_test.c

…

overlay_test.c

…

overlay.c

…

pdt.c

…

platform.c

device property: Make modifications of fwnode "flags" thread safe

2026-05-07 06:09:26 +02:00

property.c

…

resolver.c

…

unittest.c

of: unittest: fix use-after-free in testdrv_probe()

2026-05-07 06:09:27 +02:00