Re: [PATCH] usb: musb: omap2430: Do not put borrowed of_node in probe
Guangshuo Li <[email protected]> Mon, 13 Jul 2026 19:48:27 +0800
| Newsgroups | org.kernel.vger.linux-omap,org.kernel.vger.linux-kernel,org.kernel.vger.linux-usb |
|---|---|
| Message-ID | <CANUHTR9dRbRcAA4fB+uTZVWwzr3T8S5cg2x838D7t5j7yL0g6A@mail.gmail.com> |
Hi Johan, Thanks for the correction and review. On Mon, 6 Jul 2026 at 15:07, Johan Hovold <[email protected]> wrote: > > On Sun, Jul 05, 2026 at 05:14:11PM +0800, Guangshuo Li wrote: > > omap2430_probe() stores pdev->dev.of_node in a local np variable. This is > > a borrowed pointer and the probe function does not take a reference to > > it. > > > > The success and error paths nevertheless call of_node_put(np). This drops > > a reference that is owned by the platform device, and can leave > > pdev->dev.of_node with an unbalanced reference count. > > > > Do not put the borrowed platform device node from omap2430_probe(). > > References taken for the child MUSB device are handled by the device core, > > and the ctrl-module phandle reference is still released separately. > > > > Fixes: e194ce048f5a ("usb: musb: omap2430: Fix use-after-free in omap2430_probe()") > > This was not the commit that introduced the issue. This should be: > > Fixes: ffbe2feac59b ("usb: musb: omap2430: Fix probe regression for missing resources") > > and this should be backported to stable as well: > > Cc: [email protected] > > > Signed-off-by: Guangshuo Li <[email protected]> > > And again, how are you finding these issues? Still no LLM involved? > > With the above fixed: > > Reviewed-by: Johan Hovold <[email protected]> > > Johan I will fix the Fixes tag and add the stable Cc in v2. And I found this issue through manual code auditing. Thanks, Guangshuo