[PATCH v2 0/8] driver core: platform: fix swnode use-after-free on device release

[Johan Hovold <johan@kernel.org>]

When fixing a use-after-free regression in 7.3, I noticed that the
software node implementation is internally inconsistent.

Specifically, the firmware node pointer of a struct device may point to
either a primary or secondary firmware node, but in several places
kernel-doc and comments suggests that the firmware node pointer always
points to a primary node (cf. [1][2]).

This series fixes the 7.3 regression along with a similar issue in i2c
core due which are both stem from the fact that
device_remove_software_node() happens to drop a reference to a primary
software node that was never added by device_add_software_node().

The next two patches clarify that device_remove_software_node() should
only be used to remove nodes added by device_add_software_node() and
stops touching primary nodes.

The rest of the series addresses further inconsistencies.

The first two fixes could go into 7.4 and the rest (which depends on the
fixes) into 7.5. And with an ack from the i2c maintainer for patches 2/8
and 4/8.

Johan


[1] 97badf873ab6 ("device property: Make it possible to use secondary firmware nodes")
[2] 3f7bddaf5d5a ("device property: add description of fwnode cases")


Changes in v2
 - rename temporary variable and amend comment as dev->fwnode is not
   always a primary node (patch 1/8)
 - fix related UAF in i2c core (patch 2/8, new)
 - fix inconsistencies in interfaces, kernel-doc, and comments (patches
   3-8, new).


Johan Hovold (8):
  driver core: platform: fix swnode use-after-free on device release
  i2c: core: fix swnode use-after-free on client deregistration
  swnode: fix device_add_of_node() kernel doc
  swnode: ignore primary nodes in device_remove_software_node()
  driver core: platform: warn on bad fwnode assignment
  driver core: platform: tests: fix swnode reuse test description
  swnode: fix software_node_notify() primary node comment
  device property: fix fwnode_get_next_child_node() comments

 drivers/base/core.c                      |  3 ++-
 drivers/base/platform.c                  | 32 +++++++++++-------------
 drivers/base/property.c                  |  6 ++---
 drivers/base/swnode.c                    | 20 ++++++++-------
 drivers/base/test/platform-device-test.c |  5 ++--
 drivers/i2c/i2c-core-base.c              | 10 +++-----
 include/linux/device.h                   |  1 +
 7 files changed, 39 insertions(+), 38 deletions(-)

-- 
2.56.0