github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-13 15:40:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown

Browse Source 
In gpio_secondary_fwnode_init(), acpi_bus_find_device_by_name() returns a
device reference, but the local dev variable is declared with
__free(put_device), dropping the reference at the end of each iteration.
Meanwhile, devm_add_action_or_reset() saves the dev pointer for
gpio_secondary_unset() without incrementing its reference count, which
could lead to a use-after-free during driver teardown if the device is
released in the interim.

Acquire an explicit device reference with get_device() when registering
the devres action, and drop it with put_device() inside
gpio_secondary_unset().

Fixes: 1448c2d2ca ("platform/x86: x86-android-tablets: enable fwnode matching of GPIO chips")
Assisted-by: LLM
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Hans de Goede <johannes.goede@oss.qualcomm.com> # Yoga tab 2 1380, yt3
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260830-x86-android-lenovo-swnode-v1-2-066a91acb4ba@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
This commit is contained in:
Dmitry Torokhov 2026-08-30 04:15:06 -07:00 committed by Ilpo Järvinen
parent 355b6558dd
commit 144113b0a7
No known key found for this signature in database
GPG Key ID: 59AC4F6153E5CE31
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/platform/x86/x86-android-tablets/core.c
View File

@ -367,6 +367,7 @@ static void gpio_secondary_unset(void *data)
struct device *dev = data;
set_secondary_fwnode(dev, NULL);
put_device(dev);
}
static void gpio_secondary_unregister_node_group(void *data)
@ -409,7 +410,7 @@ static int gpio_secondary_fwnode_init(struct device *parent)
set_secondary_fwnode(dev, fwnode);
ret = devm_add_action_or_reset(parent, gpio_secondary_unset, dev);
ret = devm_add_action_or_reset(parent, gpio_secondary_unset, get_device(dev));
if (ret)
return ret;
}