Re: [PATCH v2 2/8] i2c: core: fix swnode use-after-free on client deregistration

[Andy Shevchenko <andriy.shevchenko@linux.intel.com>]

On Tue, Nov 10, 2026 at 09:51:18AM +0100, Johan Hovold wrote:
> If a client has both a primary and a secondary firmware node, the
> secondary node is accessed via the ->secondary pointer of the primary
> node.
> 
> Use a temporary variable to track whether the firmware node is a
> software node and remove any software node before dropping its reference
> to avoid a use-after-free in device_remove_software_node() when
> accessing the secondary firmware node.

...

> Fixes: df6d7277e552 ("i2c: core: Do not dereference fwnode in struct device")
> Fixes: 1c24e5fc0c70 ("i2c: core: Fix double-free of fwnode in i2c_unregister_device()")
> Cc: stable@vger.kernel.org	# 6.16

> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Cc: Hans de Goede <hansg@kernel.org>

Can we keep these two Cc out of the commit message?

> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---

...

>  	struct fwnode_handle *fwnode;
> +	bool fwnode_is_software_node;
>  
>  	if (IS_ERR_OR_NULL(client))
>  		return;
> @@ -1066,14 +1067,14 @@ void i2c_unregister_device(struct i2c_client *client)
>  	else if (is_acpi_device_node(fwnode))
>  		acpi_device_clear_enumerated(to_acpi_device_node(fwnode));
>  
> +	fwnode_is_software_node = is_software_node(fwnode);
> +	device_remove_software_node(&client->dev);
>  	/*
> -	 * If the primary fwnode is a software node it is free-ed by
> -	 * device_remove_software_node() below, avoid double-free.
> +	 * If the firmware node is a software node, its reference count
> +	 * was decremented by device_remove_software_node().
>  	 */
> -	if (!is_software_node(fwnode))
> +	if (!fwnode_is_software_node)
>  		fwnode_handle_put(fwnode);

Do I understand correctly that this is a dup with the platform device case? Can
we make a helper (on swnode API level) to cover any other existing or potential
case to avoid similar issues in the future?

-- 
With Best Regards,
Andy Shevchenko