From e7280ab196ba4bcef6d3f6ee860bf0d2c8e96e51 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:45:59 +0200 Subject: [PATCH 01/19] ACPI: bus: Use acpi/acpi_bus.h without CONFIG_ACPI Corrently acpi/acpi_bus.h is included in linux/acpi.h only if CONFIG_ACPI is set, but it contains declarations that are useful otherwise too. For consistency, modify linux/acpi.h to always include acpi/acpi_bus.h and update the latter to avoid exposing too much when CONFIG_ACPI is not set. Since acpi_has_method() is called from some code build when CONFIG_ACPI is unset, add a stub for it to the !CONFIG_ACPI block in acpi/acpi_bus.h. Signed-off-by: Rafael J. Wysocki Reviewed-by: Sudeep Holla Link: https://patch.msgid.link/3717753.iIbC2pHGDl@rafael.j.wysocki --- include/acpi/acpi_bus.h | 12 ++++++++---- include/linux/acpi.h | 2 +- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h index a10a591c18b2..32837f507f40 100644 --- a/include/acpi/acpi_bus.h +++ b/include/acpi/acpi_bus.h @@ -9,6 +9,8 @@ #ifndef __ACPI_BUS_H__ #define __ACPI_BUS_H__ +#ifdef CONFIG_ACPI + #include #include #include @@ -58,7 +60,6 @@ bool acpi_dock_match(acpi_handle handle); bool acpi_check_dsm(acpi_handle handle, const guid_t *guid, u64 rev, u64 funcs); union acpi_object *acpi_evaluate_dsm(acpi_handle handle, const guid_t *guid, u64 rev, u64 func, union acpi_object *argv4); -#ifdef CONFIG_ACPI bool acpi_get_physical_device_location(acpi_handle handle, struct acpi_pld_info **pld); @@ -77,7 +78,6 @@ acpi_evaluate_dsm_typed(acpi_handle handle, const guid_t *guid, u64 rev, return obj; } -#endif #define ACPI_INIT_DSM_ARGV4(cnt, eles) \ { \ @@ -90,8 +90,6 @@ bool acpi_dev_found(const char *hid); bool acpi_dev_present(const char *hid, const char *uid, s64 hrv); bool acpi_reduced_hardware(void); -#ifdef CONFIG_ACPI - struct proc_dir_entry; #define ACPI_BUS_FILE_ROOT "acpi" @@ -942,8 +940,14 @@ int acpi_wait_for_acpi_ipmi(void); int acpi_scan_add_dep(acpi_handle handle, struct acpi_handle_list *dep_devices); u32 arch_acpi_add_auto_dep(acpi_handle handle); + #else /* CONFIG_ACPI */ +static inline bool acpi_has_method(acpi_handle handle, char *name) +{ + return false; +} + static inline struct device *acpi_bus_get_primary_device(struct acpi_device *adev) { return NULL; diff --git a/include/linux/acpi.h b/include/linux/acpi.h index ddacac812094..ba5234bd93a2 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -25,6 +25,7 @@ struct irq_domain_ops; #define _LINUX #endif #include +#include #include #ifdef CONFIG_ACPI @@ -35,7 +36,6 @@ struct irq_domain_ops; #include #include -#include #include #include #include From 28bfd74601a4ac16310b0797c24e6220108c58d1 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:46:37 +0200 Subject: [PATCH 02/19] ACPI: amba: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Acked-by: Hanjun Guo Reviewed-by: Sudeep Holla Link: https://patch.msgid.link/3362405.5fSG56mABF@rafael.j.wysocki --- drivers/acpi/arm64/amba.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/arm64/amba.c b/drivers/acpi/arm64/amba.c index 1350083bce5f..7ee431d9464a 100644 --- a/drivers/acpi/arm64/amba.c +++ b/drivers/acpi/arm64/amba.c @@ -87,11 +87,12 @@ static int amba_handler_attach(struct acpi_device *adev, * the amba device we are about to create. */ if (parent) - dev->dev.parent = acpi_get_first_physical_node(parent); + dev->dev.parent = acpi_bus_get_primary_device(parent); device_set_node(&dev->dev, acpi_fwnode_handle(adev)); ret = amba_device_add(dev, &iomem_resource); + put_device(dev->dev.parent); if (ret) { dev_err(&adev->dev, "%s(): amba_device_add() failed (%d)\n", __func__, ret); From 574799253d1598f7dec5f57a261a8773ac9179f9 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:48:30 +0200 Subject: [PATCH 03/19] platform/x86: yogabook: Switch to use acpi_bus_get_primary_device() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ilpo Järvinen Reviewed-by: Hans de Goede Reviewed-by: Mark Pearson Link: https://patch.msgid.link/1973238.CQOukoFCf9@rafael.j.wysocki --- drivers/platform/x86/lenovo/yogabook.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/platform/x86/lenovo/yogabook.c b/drivers/platform/x86/lenovo/yogabook.c index 1a4b2ab1f35d..8a91d440724b 100644 --- a/drivers/platform/x86/lenovo/yogabook.c +++ b/drivers/platform/x86/lenovo/yogabook.c @@ -353,13 +353,13 @@ static int yogabook_wmi_probe(struct wmi_device *wdev, const void *context) goto error_put_devs; } - data->kbd_dev = get_device(acpi_get_first_physical_node(data->kbd_adev)); + data->kbd_dev = acpi_bus_get_primary_device(data->kbd_adev); if (!data->kbd_dev || !data->kbd_dev->driver) { r = -EPROBE_DEFER; goto error_put_devs; } - data->dig_dev = get_device(acpi_get_first_physical_node(data->dig_adev)); + data->dig_dev = acpi_bus_get_primary_device(data->dig_adev); if (!data->dig_dev || !data->dig_dev->driver) { r = -EPROBE_DEFER; goto error_put_devs; From 790b502a4b019a71f1c3e1d7904c7426ac2f2e11 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:49:07 +0200 Subject: [PATCH 04/19] platform/x86: serdev_helpers: Switch to use acpi_bus_get_primary_device() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ilpo Järvinen Reviewed-by: Hans de Goede Link: https://patch.msgid.link/2720286.Lt9SDvczpP@rafael.j.wysocki --- drivers/platform/x86/serdev_helpers.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/platform/x86/serdev_helpers.h b/drivers/platform/x86/serdev_helpers.h index 57eac75805e2..20267e1941f1 100644 --- a/drivers/platform/x86/serdev_helpers.h +++ b/drivers/platform/x86/serdev_helpers.h @@ -74,8 +74,7 @@ get_serdev_controller(const char *serial_ctrl_hid, return ERR_PTR(-ENODEV); } - /* get_first_physical_node() returns a weak ref */ - parent = get_device(acpi_get_first_physical_node(adev)); + parent = acpi_bus_get_primary_device(adev); acpi_dev_put(adev); if (!parent) { pr_err("error could not get %s/%s serial-ctrl physical node\n", From 2058cd0f59caf475c8efad843b900a3119eb3a5c Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:50:28 +0200 Subject: [PATCH 05/19] platform/x86: x86-android-tablets: Use acpi_bus_get_primary_device() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ilpo Järvinen Reviewed-by: Hans de Goede Link: https://patch.msgid.link/3912360.MHq7AAxBmi@rafael.j.wysocki --- drivers/platform/x86/x86-android-tablets/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/platform/x86/x86-android-tablets/core.c b/drivers/platform/x86/x86-android-tablets/core.c index cfff7f5eac5d..2c262f117235 100644 --- a/drivers/platform/x86/x86-android-tablets/core.c +++ b/drivers/platform/x86/x86-android-tablets/core.c @@ -390,7 +390,6 @@ static int gpio_secondary_fwnode_init(struct device *parent, { const struct software_node *const *swnode; struct fwnode_handle *fwnode; - struct device *phys_dev; int ret; if (!node_group) @@ -418,7 +417,8 @@ static int gpio_secondary_fwnode_init(struct device *parent, if (WARN_ON(!fwnode)) return -ENOENT; - phys_dev = acpi_get_first_physical_node(to_acpi_device(dev)); + struct device *phys_dev __free(put_device) = + acpi_bus_get_primary_device(to_acpi_device(dev)); if (!phys_dev) return dev_err_probe(parent, -ENODEV, "No physical device for ACPI GPIO dev: %pfwP\n", From 7a4c8ddba1dcf7c63b329d81de1d494188e5d2b0 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:49:49 +0200 Subject: [PATCH 06/19] platform/x86: apple-gmux: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Reviewed-by: Hans de Goede Link: https://patch.msgid.link/2287208.Mh6RI2rZIc@rafael.j.wysocki --- include/linux/apple-gmux.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/apple-gmux.h b/include/linux/apple-gmux.h index 206d97ffda79..d7939c3a08fd 100644 --- a/include/linux/apple-gmux.h +++ b/include/linux/apple-gmux.h @@ -109,7 +109,7 @@ static inline bool apple_gmux_detect(struct pnp_dev *pnp_dev, enum apple_gmux_ty if (!adev) return false; - dev = get_device(acpi_get_first_physical_node(adev)); + dev = acpi_bus_get_primary_device(adev); acpi_dev_put(adev); if (!dev) return false; From 37a78048d6161e13f61ab773dcbd6e7ba965e978 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:51:06 +0200 Subject: [PATCH 07/19] thunderbolt: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Acked-by: Mika Westerberg Link: https://patch.msgid.link/1941270.atdPhlSkOF@rafael.j.wysocki --- drivers/thunderbolt/acpi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/thunderbolt/acpi.c b/drivers/thunderbolt/acpi.c index 53546bc477a5..be91bc604900 100644 --- a/drivers/thunderbolt/acpi.c +++ b/drivers/thunderbolt/acpi.c @@ -17,8 +17,8 @@ static acpi_status tb_acpi_add_link(acpi_handle handle, u32 level, void *data, struct acpi_device *adev = acpi_fetch_acpi_dev(handle); struct fwnode_handle *fwnode; struct tb_nhi *nhi = data; + struct device *dev = NULL; struct pci_dev *pdev; - struct device *dev; if (!adev) return AE_OK; @@ -37,7 +37,7 @@ static acpi_status tb_acpi_add_link(acpi_handle handle, u32 level, void *data, * USB3 ports might not even have a physical device yet if xHCI driver * isn't bound yet. */ - dev = acpi_get_first_physical_node(adev); + dev = acpi_bus_get_primary_device(adev); if (!dev || !dev_is_pci(dev)) goto out_put; @@ -74,6 +74,7 @@ static acpi_status tb_acpi_add_link(acpi_handle handle, u32 level, void *data, } out_put: + put_device(dev); fwnode_handle_put(fwnode); return AE_OK; } From 6f50ab7ab1f93e874fa75d18bf98bbca4ce0204f Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:53:51 +0200 Subject: [PATCH 08/19] ASoC: amd: acp-es8336: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. It also fixes a device reference counting issue that may lead to a premature device release if gpiod_get_optional() fails in st_es8336_late_probe(). Fixes: 02527c3f2300 ("ASoC: amd: add Machine driver for Jadeite platform") Signed-off-by: Rafael J. Wysocki Acked-by: Mark Brown Link: https://patch.msgid.link/2063881.yKVeVyVuyW@rafael.j.wysocki --- sound/soc/amd/acp-es8336.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/amd/acp-es8336.c b/sound/soc/amd/acp-es8336.c index 9f3f11256788..34e953d1a3a7 100644 --- a/sound/soc/amd/acp-es8336.c +++ b/sound/soc/amd/acp-es8336.c @@ -198,7 +198,7 @@ static int st_es8336_late_probe(struct snd_soc_card *card) if (!adev) return -ENODEV; - codec_dev = acpi_get_first_physical_node(adev); + codec_dev = acpi_bus_get_primary_device(adev); acpi_dev_put(adev); if (!codec_dev) { dev_err(card->dev, "can not find codec dev\n"); From aae5bd00ced5b7e42ef3b3aa46923ad72388c60b Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:54:29 +0200 Subject: [PATCH 09/19] ASoC: amd: acp3x-es83xx: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. It also fixes a device reference counting issue that may lead to a premature device release if devm_kzalloc() fails in acp3x_es83xx_probe(). Fixes: 54fcd9dd44b2 ("ASoC: amd: acp: Add machine driver that enables sound for systems with a ES8336 codec") Signed-off-by: Rafael J. Wysocki Acked-by: Mark Brown Link: https://patch.msgid.link/2310746.NgBsaNRSFp@rafael.j.wysocki --- sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c b/sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c index 3a640e652314..c522b421e1ec 100644 --- a/sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c +++ b/sound/soc/amd/acp/acp3x-es83xx/acp3x-es83xx.c @@ -428,7 +428,7 @@ static int acp3x_es83xx_probe(struct snd_soc_card *card) return -ENXIO; } - codec_dev = acpi_get_first_physical_node(adev); + codec_dev = acpi_bus_get_primary_device(adev); acpi_dev_put(adev); if (!codec_dev) { dev_warn(dev, "Error cannot find codec device, will defer probe\n"); From e1aee48abfaeed1fe1a88018066d2f06c98c065f Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:55:15 +0200 Subject: [PATCH 10/19] ASoC: intel: boards: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Acked-by: Cezary Rojewski Acked-by: Mark Brown Link: https://patch.msgid.link/15844908.tv2OnDr8pf@rafael.j.wysocki --- sound/soc/intel/boards/bytcht_es8316.c | 4 ++-- sound/soc/intel/boards/bytcr_rt5640.c | 4 ++-- sound/soc/intel/boards/bytcr_rt5651.c | 4 ++-- sound/soc/intel/boards/cht_bsw_rt5645.c | 5 ++--- sound/soc/intel/boards/sof_cirrus_common.c | 2 +- sound/soc/intel/boards/sof_es8336.c | 4 ++-- 6 files changed, 11 insertions(+), 12 deletions(-) diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c index ea387dc74273..4d8d1d176a49 100644 --- a/sound/soc/intel/boards/bytcht_es8316.c +++ b/sound/soc/intel/boards/bytcht_es8316.c @@ -601,11 +601,11 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev) return -ENOENT; } - codec_dev = acpi_get_first_physical_node(adev); + codec_dev = acpi_bus_get_primary_device(adev); acpi_dev_put(adev); if (!codec_dev) return -EPROBE_DEFER; - priv->codec_dev = get_device(codec_dev); + priv->codec_dev = codec_dev; /* override platform name, if required */ byt_cht_es8316_card.dev = dev; diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c index 40da3eea5fa7..c84b9a0fe65a 100644 --- a/sound/soc/intel/boards/bytcr_rt5640.c +++ b/sound/soc/intel/boards/bytcr_rt5640.c @@ -1744,11 +1744,11 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) return -ENOENT; } - codec_dev = acpi_get_first_physical_node(adev); + codec_dev = acpi_bus_get_primary_device(adev); acpi_dev_put(adev); if (codec_dev) { - priv->codec_dev = get_device(codec_dev); + priv->codec_dev = codec_dev; } else { /* * Special case for Android tablets where the codec i2c_client diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c index 62cb4856c797..a0ed56d285bc 100644 --- a/sound/soc/intel/boards/bytcr_rt5651.c +++ b/sound/soc/intel/boards/bytcr_rt5651.c @@ -943,11 +943,11 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev) return -ENOENT; } - codec_dev = acpi_get_first_physical_node(adev); + codec_dev = acpi_bus_get_primary_device(adev); acpi_dev_put(adev); if (!codec_dev) return -EPROBE_DEFER; - priv->codec_dev = get_device(codec_dev); + priv->codec_dev = codec_dev; /* * swap SSP0 if bytcr is detected diff --git a/sound/soc/intel/boards/cht_bsw_rt5645.c b/sound/soc/intel/boards/cht_bsw_rt5645.c index 249be121be15..4f20928a3604 100644 --- a/sound/soc/intel/boards/cht_bsw_rt5645.c +++ b/sound/soc/intel/boards/cht_bsw_rt5645.c @@ -529,7 +529,6 @@ static int snd_cht_mc_probe(struct platform_device *pdev) const char *platform_name; struct cht_mc_private *drv; struct acpi_device *adev; - struct device *codec_dev; bool sof_parent; bool found = false; bool is_bytcr = false; @@ -583,8 +582,8 @@ static int snd_cht_mc_probe(struct platform_device *pdev) return -ENOENT; } - /* acpi_get_first_physical_node() returns a borrowed ref, no need to deref */ - codec_dev = acpi_get_first_physical_node(adev); + struct device *codec_dev __free(put_device) = acpi_bus_get_primary_device(adev); + acpi_dev_put(adev); if (!codec_dev) return -EPROBE_DEFER; diff --git a/sound/soc/intel/boards/sof_cirrus_common.c b/sound/soc/intel/boards/sof_cirrus_common.c index 88fc6cb2bfd4..a4ecb1f9a615 100644 --- a/sound/soc/intel/boards/sof_cirrus_common.c +++ b/sound/soc/intel/boards/sof_cirrus_common.c @@ -168,7 +168,7 @@ static int cs35l41_compute_codec_conf(void) cs35l41_name_prefixes[uid]); continue; } - physdev = get_device(acpi_get_first_physical_node(adev)); + physdev = acpi_bus_get_primary_device(adev); acpi_dev_put(adev); if (!physdev) { pr_devel("Cannot find physical node for HID %s UID %u (%s)\n", CS35L41_HID, diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c index f1e62c2e79fe..d40f10c6ae54 100644 --- a/sound/soc/intel/boards/sof_es8336.c +++ b/sound/soc/intel/boards/sof_es8336.c @@ -702,11 +702,11 @@ static int sof_es8336_probe(struct platform_device *pdev) return -ENOENT; } - codec_dev = acpi_get_first_physical_node(adev); + codec_dev = acpi_bus_get_primary_device(adev); acpi_dev_put(adev); if (!codec_dev) return -EPROBE_DEFER; - priv->codec_dev = get_device(codec_dev); + priv->codec_dev = codec_dev; ret = snd_soc_fixup_dai_links_platform_name(&sof_es8336_card, mach->mach_params.platform); From ec6bb46cf5f70b7df2b2d87bc3a7fbe55f60abc2 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:55:56 +0200 Subject: [PATCH 11/19] ASoC: loongson: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Acked-by: Mark Brown Link: https://patch.msgid.link/2796562.BddDVKsqQX@rafael.j.wysocki --- sound/soc/loongson/loongson_card.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sound/soc/loongson/loongson_card.c b/sound/soc/loongson/loongson_card.c index 6422cc1703b6..9f3907278462 100644 --- a/sound/soc/loongson/loongson_card.c +++ b/sound/soc/loongson/loongson_card.c @@ -196,7 +196,6 @@ static int loongson_card_parse_acpi(struct loongson_card_data *data) struct snd_soc_card *card = &data->snd_card; const char *codec_dai_name; struct acpi_device *adev; - struct device *phy_dev; int i, ret; /* fixup platform name based on reference node */ @@ -204,7 +203,7 @@ static int loongson_card_parse_acpi(struct loongson_card_data *data) if (!adev) return -ENOENT; - phy_dev = acpi_get_first_physical_node(adev); + struct device *phy_dev __free(put_device) = acpi_bus_get_primary_device(adev); if (!phy_dev) return -EPROBE_DEFER; From 7df0f9ee9c5a1aa70b9b34ec719324d2961cb7a7 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 21 Sep 2026 21:52:32 +0200 Subject: [PATCH 12/19] ALSA: hda: aw88399: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Acked-by: Marco Giunta Link: https://patch.msgid.link/2568518.jE0xQCEvom@rafael.j.wysocki --- sound/hda/codecs/side-codecs/aw88399_hda.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sound/hda/codecs/side-codecs/aw88399_hda.c b/sound/hda/codecs/side-codecs/aw88399_hda.c index 11cef4923024..439ad45557a4 100644 --- a/sound/hda/codecs/side-codecs/aw88399_hda.c +++ b/sound/hda/codecs/side-codecs/aw88399_hda.c @@ -209,8 +209,7 @@ static int aw88399_hda_acpi_probe(struct aw88399_hda *aw88399) return -ENODEV; } - struct device *physdev __free(put_device) = - get_device(acpi_get_first_physical_node(adev)); + struct device *physdev __free(put_device) = acpi_bus_get_primary_device(adev); acpi_dev_put(adev); if (!physdev) return -ENODEV; From 0fa8ad52b6e3e0838a6c865d1159b6409621d91b Mon Sep 17 00:00:00 2001 From: Robin Murphy Date: Tue, 22 Sep 2026 16:26:34 +0100 Subject: [PATCH 13/19] ACPI: bus: Provide !ACPI stub for acpi_device_uid() While the likes of acpi_dev_uid_to_integer() and acpi_dev_uid_match() already have stubs for !ACPI, the basic acpi_device_uid() getter does not. Although calls in portable drivers should already be conditional on a valid acpi_device in a manner which would usually lead to compile- time elimination anyway, add a stub for the sake of completeness. Signed-off-by: Robin Murphy [ rjw: Subject tweak ] Link: https://patch.msgid.link/8325277ff0484ab869fecf662a7ea356cd00bcde.1790090794.git.robin.murphy@arm.com Signed-off-by: Rafael J. Wysocki --- include/acpi/acpi_bus.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h index 32837f507f40..dca4df750c54 100644 --- a/include/acpi/acpi_bus.h +++ b/include/acpi/acpi_bus.h @@ -963,6 +963,11 @@ static inline const char *acpi_device_hid(struct acpi_device *device) return ""; } +static inline char *acpi_device_uid(struct acpi_device *device) +{ + return NULL; +} + static inline bool acpi_get_physical_device_location(acpi_handle handle, struct acpi_pld_info **pld) { From 62d6cb1f7de0f88c6f13415e0cdb413b09cdf348 Mon Sep 17 00:00:00 2001 From: Mario Limonciello Date: Fri, 25 Sep 2026 11:26:24 -0500 Subject: [PATCH 14/19] ACPI: Add stub for acpi_find_child_device() Provide a NULL-returning stub when CONFIG_ACPI is disabled so callers can be compiled without ACPI support. Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/linux-sound/20260925131104.118993-1-arnd@kernel.org/ Suggested-by: Arnd Bergmann Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20260925162628.4142365-1-mario.limonciello@amd.com Signed-off-by: Rafael J. Wysocki --- include/acpi/acpi_bus.h | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h index dca4df750c54..c060eb8f4556 100644 --- a/include/acpi/acpi_bus.h +++ b/include/acpi/acpi_bus.h @@ -943,6 +943,13 @@ u32 arch_acpi_add_auto_dep(acpi_handle handle); #else /* CONFIG_ACPI */ +static inline struct acpi_device * +acpi_find_child_device(struct acpi_device *parent, u64 address, + bool check_children) +{ + return NULL; +} + static inline bool acpi_has_method(acpi_handle handle, char *name) { return false; From 0d20d54f089eca8cf43ecc9a2bca552d322619da Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Wed, 30 Sep 2026 20:43:03 +0200 Subject: [PATCH 15/19] iommu/arm-smmu-v3: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Reviewed-by: Nicolin Chen Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/3636226.QJadu78ljV@rafael.j.wysocki --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 5732f3ba0122..98f105798b89 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -5307,7 +5307,7 @@ static void acpi_smmu_dsdt_probe_tegra241_cmdqv(struct acpi_iort_node *node, adev = acpi_dev_get_first_match_dev("NVDA200C", uid, -1); if (adev) { /* Tegra241 CMDQV driver is responsible for put_device() */ - smmu->impl_dev = get_device(acpi_get_first_physical_node(adev)); + smmu->impl_dev = acpi_bus_get_primary_device(adev); smmu->options |= ARM_SMMU_OPT_TEGRA241_CMDQV; dev_info(smmu->dev, "found companion CMDQV device: %s\n", dev_name(smmu->impl_dev)); From 2f47382b3ea31346b46444389e0520ca3cad2c81 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Wed, 30 Sep 2026 20:42:15 +0200 Subject: [PATCH 16/19] ALSA: hda: cs35l41: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Acked-by: Takashi Iwai Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/6200303.MhkbZ0Pkbq@rafael.j.wysocki --- sound/hda/codecs/side-codecs/cs35l41_hda.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sound/hda/codecs/side-codecs/cs35l41_hda.c b/sound/hda/codecs/side-codecs/cs35l41_hda.c index 62296be45c55..32abb71dd401 100644 --- a/sound/hda/codecs/side-codecs/cs35l41_hda.c +++ b/sound/hda/codecs/side-codecs/cs35l41_hda.c @@ -1926,8 +1926,7 @@ static int cs35l41_hda_read_acpi(struct cs35l41_hda *cs35l41, const char *hid, i } cs35l41->dacpi = adev; - struct device *physdev __free(put_device) = - get_device(acpi_get_first_physical_node(adev)); + struct device *physdev __free(put_device) = acpi_bus_get_primary_device(adev); if (!physdev) { acpi_dev_put(adev); return -ENODEV; From b85fdc68f3d9ac545aa523ffdddd46c470a652b8 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Wed, 30 Sep 2026 20:42:36 +0200 Subject: [PATCH 17/19] ALSA: hda: tas2781: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Acked-by: Takashi Iwai Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/8782185.NyiUUSuA9g@rafael.j.wysocki --- sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 3 +-- sound/hda/codecs/side-codecs/tas2781_hda_spi.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c b/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c index 5e5f46c9fb6b..161ca965c63e 100644 --- a/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c +++ b/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c @@ -100,8 +100,7 @@ static int tas2781_read_acpi(struct tasdevice_priv *p, const char *hid) return -ENODEV; } - struct device *physdev __free(put_device) = - get_device(acpi_get_first_physical_node(adev)); + struct device *physdev __free(put_device) = acpi_bus_get_primary_device(adev); ret = acpi_dev_get_resources(adev, &resources, tas2781_get_i2c_res, p); if (ret < 0) { dev_err(p->dev, "Failed to get ACPI resource.\n"); diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c index da71b57a26ee..f3ba7132d2b8 100644 --- a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c +++ b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c @@ -341,8 +341,7 @@ static int tas2781_read_acpi(struct tas2781_hda *tas_hda, strscpy(p->dev_name, hid, sizeof(p->dev_name)); - struct device *physdev __free(put_device) = - get_device(acpi_get_first_physical_node(adev)); + struct device *physdev __free(put_device) = acpi_bus_get_primary_device(adev); acpi_dev_put(adev); if (!physdev) return -ENODEV; From 4ed5b18e4ebd3c8bfc353ec68c1bfc818f1b9aac Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Wed, 30 Sep 2026 20:41:40 +0200 Subject: [PATCH 18/19] efi/dev-path-parser: Switch to use acpi_bus_get_primary_device() Replace acpi_get_first_physical_node() that is slated for removal with acpi_bus_get_primary_device() that takes a reference to the device it is about to return. This addresses a potential use-after-free that may occur if the device returned by acpi_get_first_physical_node() is removed right after dropping its ACPI companion's physical_node_lock in that function. Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/3974502.kQq0lBPeGt@rafael.j.wysocki --- drivers/firmware/efi/dev-path-parser.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/efi/dev-path-parser.c b/drivers/firmware/efi/dev-path-parser.c index 13ea141c0def..e0f864cbaa8c 100644 --- a/drivers/firmware/efi/dev-path-parser.c +++ b/drivers/firmware/efi/dev-path-parser.c @@ -37,9 +37,9 @@ static long __init parse_acpi_path(const struct efi_dev_path *node, if (!adev) return -ENODEV; - phys_dev = acpi_get_first_physical_node(adev); + phys_dev = acpi_bus_get_primary_device(adev); if (phys_dev) { - *child = get_device(phys_dev); + *child = phys_dev; acpi_dev_put(adev); } else *child = &adev->dev; From 538076b45429652424801cb127581ed3dc56a0b7 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Wed, 30 Sep 2026 20:45:01 +0200 Subject: [PATCH 19/19] ACPI: bus: Drop acpi_get_first_physical_node() Fold acpi_get_first_physical_node() into acpi_primary_dev_companion() that is its only remaining caller and drop its signature from the header file. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Sudeep Holla Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/4537440.ejJDZkT8p0@rafael.j.wysocki --- drivers/acpi/bus.c | 20 +++++--------------- include/linux/acpi.h | 7 ------- 2 files changed, 5 insertions(+), 22 deletions(-) diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c index 808c6746be14..cc6989d88645 100644 --- a/drivers/acpi/bus.c +++ b/drivers/acpi/bus.c @@ -809,24 +809,14 @@ struct device *acpi_bus_get_primary_device(struct acpi_device *adev) } EXPORT_SYMBOL_GPL(acpi_bus_get_primary_device); -/** - * acpi_get_first_physical_node - Find first physical node of an ACPI device - * @adev: ACPI device in question - * - * Return: First physical node of ACPI device @adev - */ -struct device *acpi_get_first_physical_node(struct acpi_device *adev) -{ - guard(mutex)(&adev->physical_node_lock); - - return primary_physical_device(adev); -} -EXPORT_SYMBOL_GPL(acpi_get_first_physical_node); - static struct acpi_device *acpi_primary_dev_companion(struct acpi_device *adev, const struct device *dev) { - const struct device *phys_dev = acpi_get_first_physical_node(adev); + const struct device *phys_dev; + + guard(mutex)(&adev->physical_node_lock); + + phys_dev = primary_physical_device(adev); return phys_dev && phys_dev == dev ? adev : NULL; } diff --git a/include/linux/acpi.h b/include/linux/acpi.h index ba5234bd93a2..6f69819f9c9a 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -105,8 +105,6 @@ static inline const char *acpi_dev_name(struct acpi_device *adev) return dev_name(&adev->dev); } -struct device *acpi_get_first_physical_node(struct acpi_device *adev); - enum acpi_irq_model_id { ACPI_IRQ_MODEL_PIC = 0, ACPI_IRQ_MODEL_IOAPIC, @@ -938,11 +936,6 @@ static inline const char *acpi_dev_name(struct acpi_device *adev) return NULL; } -static inline struct device *acpi_get_first_physical_node(struct acpi_device *adev) -{ - return NULL; -} - static inline void acpi_early_init(void) { } static inline void acpi_subsystem_init(void) { }