ACPI: PCI: pci_link: clear driver_data before free

acpi_pci_link_remove() frees the link object without clearing the ACPI
device's driver_data pointer. The ACPI device survives hot-removal and
can later be retrieved by acpi_fetch_acpi_dev(), leaving callers with a
dangling pointer.

Clear driver_data before freeing the link.

Fixes: db89b4f0db ("ACPI: catch calls of acpi_driver_data on pointer of wrong type")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
[ rjw: Subject tweak ]
Link: https://patch.msgid.link/20260925155846.2381956-1-yaojiale02@163.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
Jiale Yao 2026-09-25 23:58:46 +08:00 committed by Rafael J. Wysocki
parent 24a19b953e
commit 691c33289b

View File

@ -787,6 +787,7 @@ static void acpi_pci_link_remove(struct acpi_device *device)
list_del(&link->list);
mutex_unlock(&acpi_link_lock);
device->driver_data = NULL;
kfree(link);
}