Wentao Liang 0ba03e06f0 of: unittest: fix use-after-free in testdrv_probe() ...

commit 07fd339b2c upstream.

The function testdrv_probe() retrieves the device_node from the PCI
device, applies an overlay, and then immediately calls of_node_put(dn).
This releases the reference held by the PCI core, potentially freeing
the node if the reference count drops to zero. Later, the same freed
pointer 'dn' is passed to of_platform_default_populate(), leading to a
use-after-free.

The reference to pdev->dev.of_node is owned by the device model and
should not be released by the driver. Remove the erroneous of_node_put()
to prevent premature freeing.

Fixes: 26409dd045 ("of: unittest: Add pci_dt_testdrv pci driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260409034859.429071-1-vulab@iscas.ac.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-05-17 17:13:27 +02:00

..

unittest-data

…

address.c

…

base.c

device property: Make modifications of fwnode "flags" thread safe

2026-05-17 17:13:26 +02:00

cpu.c

…

device.c

…

dynamic.c

device property: Make modifications of fwnode "flags" thread safe

2026-05-17 17:13:26 +02:00

fdt_address.c

…

fdt.c

…

irq.c

…

Kconfig

…

kexec.c

…

kobj.c

…

Makefile

…

module.c

…

of_numa.c

…

of_private.h

of: Add a helper to free property struct

2025-09-04 15:30:18 +02:00

of_reserved_mem.c

…

overlay.c

of: Add a helper to free property struct

2025-09-04 15:30:18 +02:00

pdt.c

…

platform.c

device property: Make modifications of fwnode "flags" thread safe

2026-05-17 17:13:26 +02:00

property.c

…

resolver.c

…

unittest.c

of: unittest: fix use-after-free in testdrv_probe()

2026-05-17 17:13:27 +02:00