[PATCH] drivers/base/node: fix UAF on device_register() failure

[PATCH] drivers/base/node: fix UAF on device_register() failure

[Linkai Gong]

node_init_node_access() frees the access node with kfree() if
device_register() fails. After device_register() the embedded device is
initialized and must be released with put_device() so that
node_access_release() can free it.

Use the same put_device error path style as node_init_cache_dev().

Fixes: 08d9dbe72b1f ("node: Link memory nodes to their compute nodes")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
 drivers/base/node.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/base/node.c b/drivers/base/node.c
index 3da91929ad4e..d2fd57c2edc8 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -176,8 +176,10 @@ static struct node_access_nodes *node_init_node_access(struct node *node,
 	pm_runtime_no_callbacks(dev);
 	list_add_tail(&access_node->list_node, &node->access_list);
 	return access_node;
+
 free_name:
-	kfree_const(dev->kobj.name);
+	put_device(dev);
+	return NULL;
 free:
 	kfree(access_node);
 	return NULL;
-- 
2.25.1

Re: [PATCH] drivers/base/node: fix UAF on device_register() failure

[Danilo Krummrich]

On Thu Aug 6, 2026 at 10:28 AM CEST, Linkai Gong wrote:
> diff --git a/drivers/base/node.c b/drivers/base/node.c
> index 3da91929ad4e..d2fd57c2edc8 100644
> --- a/drivers/base/node.c
> +++ b/drivers/base/node.c
> @@ -176,8 +176,10 @@ static struct node_access_nodes *node_init_node_access(struct node *node,
>  	pm_runtime_no_callbacks(dev);
>  	list_add_tail(&access_node->list_node, &node->access_list);
>  	return access_node;
> +
>  free_name:
> -	kfree_const(dev->kobj.name);
> +	put_device(dev);
> +	return NULL;

Good catch, but we should also rename the label; free_name is misleading.

[PATCH v2] drivers/base/node: fix UAF on device_register() failure

[Linkai Gong]

node_init_node_access() frees the access node with kfree() if
device_register() fails. After device_register() the embedded device is
initialized and must be released with put_device() so that
node_access_release() can free it.

Use the same put_device error path style as node_init_cache_dev().

Fixes: 08d9dbe72b1f ("node: Link memory nodes to their compute nodes")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
v2:
- rename the free_name error label to put_device (Danilo)

 drivers/base/node.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/base/node.c b/drivers/base/node.c
index 3da91929ad4e..d5eec2ef76dd 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -171,13 +171,14 @@ static struct node_access_nodes *node_init_node_access(struct node *node,
 		goto free;
 
 	if (device_register(dev))
-		goto free_name;
+		goto put_device;
 
 	pm_runtime_no_callbacks(dev);
 	list_add_tail(&access_node->list_node, &node->access_list);
 	return access_node;
-free_name:
-	kfree_const(dev->kobj.name);
+put_device:
+	put_device(dev);
+	return NULL;
 free:
 	kfree(access_node);
 	return NULL;
-- 
2.25.1

Re: [PATCH v2] drivers/base/node: fix UAF on device_register() failure

[Danilo Krummrich]

On Fri Aug 28, 2026 at 3:25 AM CEST, Linkai Gong wrote:
> diff --git a/drivers/base/node.c b/drivers/base/node.c
> index 3da91929ad4e..d5eec2ef76dd 100644
> --- a/drivers/base/node.c
> +++ b/drivers/base/node.c
> @@ -171,13 +171,14 @@ static struct node_access_nodes *node_init_node_access(struct node *node,
>  		goto free;
>  
>  	if (device_register(dev))
> -		goto free_name;
> +		goto put_device;
>  
>  	pm_runtime_no_callbacks(dev);
>  	list_add_tail(&access_node->list_node, &node->access_list);
>  	return access_node;
> -free_name:
> -	kfree_const(dev->kobj.name);
> +put_device:
> +	put_device(dev);
> +	return NULL;
>  free:
>  	kfree(access_node);
>  	return NULL;

Sorry I didn't notice this in the first version, but why do we keep the goto
labels at all if they both end with a return statement? Can't we just get rid of
both?

Thanks,
Danilo

Re: [PATCH v2] drivers/base/node: fix UAF on device_register() failure

[Linkai Gong]

On Fri, Aug 28, 2026 at 08:07:19PM +0200, Danilo Krummrich wrote:
> Sorry I didn't notice this in the first version, but why do we keep the goto
> labels at all if they both end with a return statement? Can't we just get rid of
> both?

You are right. Both labels only return, so the gotos are not needed.
I will send a v3 that inlines the two error paths.

Thanks,
Linkai

[PATCH v3] drivers/base/node: fix UAF on device_register() failure

[Linkai Gong]

node_init_node_access() frees the access node with kfree() if
device_register() fails. After device_register() the embedded device is
initialized and must be released with put_device() so that
node_access_release() can free it.

Fixes: 08d9dbe72b1f ("node: Link memory nodes to their compute nodes")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
v3:
- drop both goto labels; the error paths just return (Danilo)

v2:
- rename the free_name error label to put_device (Danilo)

 drivers/base/node.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/base/node.c b/drivers/base/node.c
index 3da91929ad4e..dcdc8626627a 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -167,20 +167,19 @@ static struct node_access_nodes *node_init_node_access(struct node *node,
 	dev->parent = &node->dev;
 	dev->release = node_access_release;
 	dev->groups = node_access_node_groups;
-	if (dev_set_name(dev, "access%u", access))
-		goto free;
+	if (dev_set_name(dev, "access%u", access)) {
+		kfree(access_node);
+		return NULL;
+	}
 
-	if (device_register(dev))
-		goto free_name;
+	if (device_register(dev)) {
+		put_device(dev);
+		return NULL;
+	}
 
 	pm_runtime_no_callbacks(dev);
 	list_add_tail(&access_node->list_node, &node->access_list);
 	return access_node;
-free_name:
-	kfree_const(dev->kobj.name);
-free:
-	kfree(access_node);
-	return NULL;
 }
 
 #ifdef CONFIG_HMEM_REPORTING
-- 
2.25.1

Re: [PATCH v3] drivers/base/node: fix UAF on device_register() failure

[Danilo Krummrich]

On Mon,  7 Sep 2026 10:47:32 +0800, Linkai Gong wrote:
> [PATCH v3] drivers/base/node: fix UAF on device_register() failure

Applied, thanks!

  Branch: driver-core-testing
  Tree:   git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git

[1/1] drivers/base/node: fix UAF on device_register() failure
      commit: 6d7e9bc51d8f

The patch will appear in the next linux-next integration (typically within 24
hours on weekdays).

The patch is in the driver-core-testing branch and will be promoted to
driver-core-next after validation.