[PATCH v1 08/17] platform/x86: x86-android-tablets: Use acpi_bus_get_primary_device()

Posted by Rafael J. Wysocki 2 days, 21 hours ago

From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>

Replace acpi_get_first_physical_node() that is slated for removal
with acpi_bus_get_primary_device() that takes a reference to the
device it is about to return.

This addresses a potential use-after-free that may occur if the
device returned by acpi_get_first_physical_node() is removed right
after dropping its ACPI companion's physical_node_lock in that
function.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
---
 drivers/platform/x86/x86-android-tablets/core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/x86/x86-android-tablets/core.c b/drivers/platform/x86/x86-android-tablets/core.c
index cfff7f5eac5d..2c262f117235 100644
--- a/drivers/platform/x86/x86-android-tablets/core.c
+++ b/drivers/platform/x86/x86-android-tablets/core.c
@@ -390,7 +390,6 @@ static int gpio_secondary_fwnode_init(struct device *parent,
 {
 	const struct software_node *const *swnode;
 	struct fwnode_handle *fwnode;
-	struct device *phys_dev;
 	int ret;
 
 	if (!node_group)
@@ -418,7 +417,8 @@ static int gpio_secondary_fwnode_init(struct device *parent,
 		if (WARN_ON(!fwnode))
 			return -ENOENT;
 
-		phys_dev = acpi_get_first_physical_node(to_acpi_device(dev));
+		struct device *phys_dev __free(put_device) =
+				acpi_bus_get_primary_device(to_acpi_device(dev));
 		if (!phys_dev)
 			return dev_err_probe(parent, -ENODEV,
 					     "No physical device for ACPI GPIO dev: %pfwP\n",
-- 
2.51.0

Re: [PATCH v1 08/17] platform/x86: x86-android-tablets: Use acpi_bus_get_primary_device()

Posted by Hans de Goede 2 days ago

Hi,

On 21-Sep-26 21:50, Rafael J. Wysocki wrote:
> From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
> 
> Replace acpi_get_first_physical_node() that is slated for removal
> with acpi_bus_get_primary_device() that takes a reference to the
> device it is about to return.
> 
> This addresses a potential use-after-free that may occur if the
> device returned by acpi_get_first_physical_node() is removed right
> after dropping its ACPI companion's physical_node_lock in that
> function.
> 
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Thanks, patch looks good to me:

Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>

Regards,

Hans

> ---
>  drivers/platform/x86/x86-android-tablets/core.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/platform/x86/x86-android-tablets/core.c b/drivers/platform/x86/x86-android-tablets/core.c
> index cfff7f5eac5d..2c262f117235 100644
> --- a/drivers/platform/x86/x86-android-tablets/core.c
> +++ b/drivers/platform/x86/x86-android-tablets/core.c
> @@ -390,7 +390,6 @@ static int gpio_secondary_fwnode_init(struct device *parent,
>  {
>  	const struct software_node *const *swnode;
>  	struct fwnode_handle *fwnode;
> -	struct device *phys_dev;
>  	int ret;
>  
>  	if (!node_group)
> @@ -418,7 +417,8 @@ static int gpio_secondary_fwnode_init(struct device *parent,
>  		if (WARN_ON(!fwnode))
>  			return -ENOENT;
>  
> -		phys_dev = acpi_get_first_physical_node(to_acpi_device(dev));
> +		struct device *phys_dev __free(put_device) =
> +				acpi_bus_get_primary_device(to_acpi_device(dev));
>  		if (!phys_dev)
>  			return dev_err_probe(parent, -ENODEV,
>  					     "No physical device for ACPI GPIO dev: %pfwP\n",

Re: [PATCH v1 08/17] platform/x86: x86-android-tablets: Use acpi_bus_get_primary_device()

Posted by Ilpo Järvinen 2 days, 4 hours ago

On Mon, 21 Sep 2026, Rafael J. Wysocki wrote:

> From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
> 
> Replace acpi_get_first_physical_node() that is slated for removal
> with acpi_bus_get_primary_device() that takes a reference to the
> device it is about to return.
> 
> This addresses a potential use-after-free that may occur if the
> device returned by acpi_get_first_physical_node() is removed right
> after dropping its ACPI companion's physical_node_lock in that
> function.
> 
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> ---
>  drivers/platform/x86/x86-android-tablets/core.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/platform/x86/x86-android-tablets/core.c b/drivers/platform/x86/x86-android-tablets/core.c
> index cfff7f5eac5d..2c262f117235 100644
> --- a/drivers/platform/x86/x86-android-tablets/core.c
> +++ b/drivers/platform/x86/x86-android-tablets/core.c
> @@ -390,7 +390,6 @@ static int gpio_secondary_fwnode_init(struct device *parent,
>  {
>  	const struct software_node *const *swnode;
>  	struct fwnode_handle *fwnode;
> -	struct device *phys_dev;
>  	int ret;
>  
>  	if (!node_group)
> @@ -418,7 +417,8 @@ static int gpio_secondary_fwnode_init(struct device *parent,
>  		if (WARN_ON(!fwnode))
>  			return -ENOENT;
>  
> -		phys_dev = acpi_get_first_physical_node(to_acpi_device(dev));
> +		struct device *phys_dev __free(put_device) =
> +				acpi_bus_get_primary_device(to_acpi_device(dev));
>  		if (!phys_dev)
>  			return dev_err_probe(parent, -ENODEV,
>  					     "No physical device for ACPI GPIO dev: %pfwP\n",
> 

Seems to be based on the latest code,

Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

-- 
 i.