Re: [PATCH net-next v4 3/5] i2c: mux: Propagate software nodes to channel adapters

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing device_remove_software_node() during normal adapter teardown leads to Use-After-Free.
--

--- Patch [3]: [PATCH net-next v4 3/5] i2c: mux: Propagate software nodes to channel adapters ---
commit dcd183b53494f861ae352813bfad4b50641126b5
Author: Ahmad Byagowi <[email protected]>

i2c: mux: Propagate software nodes to channel adapters

This commit associates equivalent software-node descriptions with adapters
created by i2c-mux. It finds the software-node child whose reg value matches
the channel and assigns it to the new adapter.

> diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
> index 681a201c239ba..040284236275f 100644
> --- a/drivers/i2c/i2c-mux.c
> +++ b/drivers/i2c/i2c-mux.c
[ ... ]
> @@ -374,6 +429,16 @@ int i2c_mux_add_adapter(struct i2c_mux_core *muxc,
>  				      ACPI_COMPANION(muxc->dev),
>  				      chan_id);
>  
> +	if (channel_node) {
> +		ret = device_add_software_node(&priv->adap.dev,
> +					       to_software_node(channel_node));
> +		if (!ret)
> +			priv->swnode = channel_node;
> +		fwnode_handle_put(channel_node);
> +		if (ret)
> +			goto err_free_priv;
> +	}
> +
[ ... ]
> @@ -430,6 +496,7 @@ void i2c_mux_del_adapters(struct i2c_mux_core *muxc)
>  
>  		sysfs_remove_link(&priv->adap.dev.kobj, "mux_device");
>  		i2c_del_adapter(adap);
> +		fwnode_handle_put(priv->swnode);

[Severity: High]
Does this create a dangling fwnode pointer in the device object, leading to a
use-after-free?

In i2c_mux_add_adapter(), the software node is attached to the adapter using
device_add_software_node(), which takes an internal reference and sets the
device's secondary fwnode. The driver properly drops its local reference
immediately via fwnode_handle_put(channel_node).

During normal teardown here in i2c_mux_del_adapters(), should this call
device_remove_software_node(&priv->adap.dev) instead of bypassing the API and
manually calling fwnode_handle_put(priv->swnode)?

Manually calling fwnode_handle_put() here drops the internal reference
acquired by the device core, freeing the software node while the device's
secondary fwnode pointer still points to it (because
device_remove_software_node() was never called to clear it). If the
unregistered device object is kept alive by other concurrent reference
holders, accessing its fwnode will result in a use-after-free.

>  		of_node_put(np);
>  		kfree(priv);
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3