drivers/acpi/arm64/amba.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Replace acpi_get_first_physical_node() that is slated for removal
with acpi_bus_get_primary_device() that takes a reference to the
device it is about to return.
This addresses a potential use-after-free that may occur if the
device returned by acpi_get_first_physical_node() is removed right
after dropping its ACPI companion's physical_node_lock in that
function.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
---
drivers/acpi/arm64/amba.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/arm64/amba.c b/drivers/acpi/arm64/amba.c
index 1350083bce5f..7ee431d9464a 100644
--- a/drivers/acpi/arm64/amba.c
+++ b/drivers/acpi/arm64/amba.c
@@ -87,11 +87,12 @@ static int amba_handler_attach(struct acpi_device *adev,
* the amba device we are about to create.
*/
if (parent)
- dev->dev.parent = acpi_get_first_physical_node(parent);
+ dev->dev.parent = acpi_bus_get_primary_device(parent);
device_set_node(&dev->dev, acpi_fwnode_handle(adev));
ret = amba_device_add(dev, &iomem_resource);
+ put_device(dev->dev.parent);
if (ret) {
dev_err(&adev->dev, "%s(): amba_device_add() failed (%d)\n",
__func__, ret);
--
2.51.0
On Mon, Sep 21, 2026 at 09:46:37PM +0200, Rafael J. Wysocki wrote: > From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> > > Replace acpi_get_first_physical_node() that is slated for removal > with acpi_bus_get_primary_device() that takes a reference to the > device it is about to return. > > This addresses a potential use-after-free that may occur if the > device returned by acpi_get_first_physical_node() is removed right > after dropping its ACPI companion's physical_node_lock in that > function. > Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> -- Regards, Sudeep
On 2026/9/22 3:46, Rafael J. Wysocki wrote: > From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> > > Replace acpi_get_first_physical_node() that is slated for removal > with acpi_bus_get_primary_device() that takes a reference to the > device it is about to return. > > This addresses a potential use-after-free that may occur if the > device returned by acpi_get_first_physical_node() is removed right > after dropping its ACPI companion's physical_node_lock in that > function. > > Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> > --- > drivers/acpi/arm64/amba.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > Acked-by: Hanjun Guo <guohanjun@huawei.com> Thanks Hanjun
© 2016 - 2026 Red Hat, Inc.