From 691c33289b4d7a50b6fe1e03918bfbc21d4641c5 Mon Sep 17 00:00:00 2001 From: Jiale Yao Date: Fri, 25 Sep 2026 23:58:46 +0800 Subject: [PATCH] ACPI: PCI: pci_link: clear driver_data before free acpi_pci_link_remove() frees the link object without clearing the ACPI device's driver_data pointer. The ACPI device survives hot-removal and can later be retrieved by acpi_fetch_acpi_dev(), leaving callers with a dangling pointer. Clear driver_data before freeing the link. Fixes: db89b4f0dbab ("ACPI: catch calls of acpi_driver_data on pointer of wrong type") Signed-off-by: Jiale Yao [ rjw: Subject tweak ] Link: https://patch.msgid.link/20260925155846.2381956-1-yaojiale02@163.com Signed-off-by: Rafael J. Wysocki --- drivers/acpi/pci_link.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c index e6ed13aee48d..84bfcdf242dd 100644 --- a/drivers/acpi/pci_link.c +++ b/drivers/acpi/pci_link.c @@ -787,6 +787,7 @@ static void acpi_pci_link_remove(struct acpi_device *device) list_del(&link->list); mutex_unlock(&acpi_link_lock); + device->driver_data = NULL; kfree(link); }