kernel/linux.git/drivers/of/unittest.c, branch v7.1

of: unittest: fix use-after-free in testdrv_probe()

2026-04-16T12:27:17+00:00

The function testdrv_probe() retrieves the device_node from the PCI device, applies an overlay, and then immediately calls of_node_put(dn). This releases the reference held by the PCI core, potentially freeing the node if the reference count drops to zero. Later, the same freed pointer 'dn' is passed to of_platform_default_populate(), leading to a use-after-free. The reference to pdev->dev.of_node is owned by the device model and should not be released by the driver. Remove the erroneous of_node_put() to prevent premature freeing. Fixes: 26409dd04589 ("of: unittest: Add pci_dt_testdrv pci driver") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Link: https://patch.msgid.link/20260409034859.429071-1-vulab@iscas.ac.cn Signed-off-by: Rob Herring (Arm)

of: unittest: fix use-after-free in of_unittest_changeset()

2026-04-16T12:27:17+00:00

The variable 'parent' is assigned the value of 'nchangeset' earlier in the function, meaning both point to the same struct device_node. The call to of_node_put(nchangeset) can decrement the reference count to zero and free the node if there are no other holders. After that, the code still uses 'parent' to check for the presence of a property and to read a string property, leading to a use-after-free. Fix this by moving the of_node_put() call after the last access to 'parent', avoiding the UAF. Fixes: 1c668ea65506 ("of: unittest: Use of_property_present()") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Link: https://patch.msgid.link/20260409022233.418103-1-vulab@iscas.ac.cn Signed-off-by: Rob Herring (Arm)

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

Merge tag 'devicetree-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2026-02-12T02:27:08+00:00

Pull devicetree updates from Rob Herring: "DT core: - Sync dtc/libfdt with upstream v1.7.2-62-ga26ef6400bd8 - Add a for_each_compatible_node_scoped() loop and convert users in cpufreq, dmaengine, clk, cdx, powerpc and Arm - Simplify of/platform.c with scoped loop helpers - Add fw_devlink tracking for "mmc-pwrseq" - Optimize fw_devlink callback code size for pinctrl-N properties - Replace strcmp_suffix() with strends() DT bindings: - Support building single binding targets - Convert google,goldfish-fb, cznic,turris-mox-rwtm, ti,prm-inst - Add bindings for Freescale AVIC, Realtek RTD1xxx system controllers, Microchip 25AA010A EEPROM, OnSemi FIN3385, IEI WT61P803 PUZZLE, Delta Electronics DPS-800-AB power supply, Infineon IR35221 Digital Multi-phase Controller, Infineon PXE1610 Digital Dual Output 6+1 VR12.5 & VR13 CPU Controller, socionext,uniphier-smpctrl, and xlnx,zynqmp-firmware - Lots of trivial binding fixes to address warnings in DTS files. These are mostly for arm64 platforms which is getting closer to be warning free. Some public shaming has helped. - Fix I2C bus node names in examples - Drop obsolete brcm,vulcan-soc binding - Drop unreferenced binding headers" * tag 'devicetree-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (60 commits) dt-bindings: interrupt-controller: Add compatiblie string fsl,imx(1|25|27|31|35)-avic dt-bindings: soc: imx: add fsl,aips and fsl,emi compatible strings dt-bindings: display: bridge: lt8912b: Drop reset gpio requirement dt-bindings: firmware: fsl,scu: Mark multi-channel MU layouts as deprecated cpufreq: s5pv210: Simplify with scoped for each OF child loop dmaengine: fsl_raid: Simplify with scoped for each OF child loop clk: imx: imx31: Simplify with scoped for each OF child loop clk: imx: imx27: Simplify with scoped for each OF child loop cdx: Use mutex guard to simplify error handling cdx: Simplify with scoped for each OF child loop powerpc/wii: Simplify with scoped for each OF child loop powerpc/fsp2: Simplify with scoped for each OF child loop ARM: exynos: Simplify with scoped for each OF child loop ARM: at91: Simplify with scoped for each OF child loop of: Add for_each_compatible_node_scoped() helper dt-bindings: Fix emails with spaces or missing brackets scripts/dtc: Update to upstream version v1.7.2-62-ga26ef6400bd8 dt-bindings: crypto: inside-secure,safexcel: Mandate only ring IRQs dt-bindings: crypto: inside-secure,safexcel: Add SoC compatibles of: reserved_mem: Fix placement of __free() annotation ...

Merge tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

2026-02-11T04:45:30+00:00

Pull SoC driver updates from Arnd Bergmann: "There are are a number of to firmware drivers, in particular the TEE subsystem: - a bus callback for TEE firmware that device drivers can register to - sysfs support for tee firmware information - minor updates to platform specific TEE drivers for AMD, NXP, Qualcomm and the generic optee driver - ARM SCMI firmware refactoring to improve the protocol discover among other fixes and cleanups - ARM FF-A firmware interoperability improvements The reset controller and memory controller subsystems gain support for additional hardware platforms from Mediatek, Renesas, NXP, Canaan and SpacemiT. Most of the other changes are for random drivers/soc code. Among a number of cleanups and newly added hardware support, including: - Mediatek MT8196 DVFS power management and mailbox support - Qualcomm SCM firmware and MDT loader refactoring, as part of the new Glymur platform support. - NXP i.MX9 System Manager firmware support for accessing the syslog - Minor updates for TI, Renesas, Samsung, Apple, Marvell and AMD SoCs" * tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (171 commits) bus: fsl-mc: fix an error handling in fsl_mc_device_add() reset: spacemit: Add SpacemiT K3 reset driver reset: spacemit: Extract common K1 reset code reset: Create subdirectory for SpacemiT drivers dt-bindings: soc: spacemit: Add K3 reset support and IDs reset: canaan: k230: drop OF dependency and enable by default reset: rzg2l-usbphy-ctrl: Add suspend/resume support reset: rzg2l-usbphy-ctrl: Propagate the return value of regmap_field_update_bits() reset: gpio: check the return value of gpiod_set_value_cansleep() reset: imx8mp-audiomix: Support i.MX8ULP SIM LPAV reset: imx8mp-audiomix: Extend the driver usage reset: imx8mp-audiomix: Switch to using regmap API reset: imx8mp-audiomix: Drop unneeded macros soc: fsl: qe: qe_ports_ic: Consolidate chained IRQ handler install/remove soc: mediatek: mtk-cmdq: Add mminfra_offset adjustment for DRAM addresses soc: mediatek: mtk-cmdq: Extend cmdq_pkt_write API for SoCs without subsys ID soc: mediatek: mtk-cmdq: Add pa_base parsing for hardware without subsys ID support soc: mediatek: mtk-cmdq: Add cmdq_get_mbox_priv() in cmdq_pkt_create() mailbox: mtk-cmdq: Add driver data to support for MT8196 mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transaction ...

of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy()

2026-02-04T02:58:10+00:00

This function first duplicates p1 and p2 into new, and then checks whether the duplication succeeds. However, if the duplication fails (e.g., kzalloc() returns NULL in __of_prop_dup()), new will be NULL but is still dereferenced in __of_prop_free(). To ensure that the unit test continues to run even when duplication fails, add a NULL check before calling __of_prop_free(). Fixes: 1c5e3d9bf33b ("of: Add a helper to free property struct") Signed-off-by: Tuo Li Link: https://patch.msgid.link/20260105071438.156186-1-islituo@gmail.com Signed-off-by: Rob Herring (Arm)

of: unittest: Add a test case for for_each_of_imap_item iterator

2026-01-15T11:03:27+00:00

Recently for_each_of_imap_item iterator has been introduce to help drivers in parsing the interrupt-map property. Add a test case for this iterator. Signed-off-by: Herve Codina (Schneider Electric) Reviewed-by: Rob Herring (Arm) Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260114093938.1089936-3-herve.codina@bootlin.com Signed-off-by: Geert Uytterhoeven

of: unittest: Fix memory leak in unittest_data_add()

2026-01-02T21:36:37+00:00

In unittest_data_add(), if of_resolve_phandles() fails, the allocated unittest_data is not freed, leading to a memory leak. Fix this by using scope-based cleanup helper __free(kfree) for automatic resource cleanup. This ensures unittest_data is automatically freed when it goes out of scope in error paths. For the success path, use retain_and_null_ptr() to transfer ownership of the memory to the device tree and prevent double freeing. Fixes: 2eb46da2a760 ("of/selftest: Use the resolver to fixup phandles") Suggested-by: Rob Herring Co-developed-by: Jianhao Xu Signed-off-by: Jianhao Xu Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20251231114915.234638-1-zilin@seu.edu.cn Signed-off-by: Rob Herring (Arm)

of: unittest: Fix device reference count leak in of_unittest_pci_node_verify

2025-10-01T14:33:23+00:00

In of_unittest_pci_node_verify(), when the add parameter is false, device_find_any_child() obtains a reference to a child device. This function implicitly calls get_device() to increment the device's reference count before returning the pointer. However, the caller fails to properly release this reference by calling put_device(), leading to a device reference count leak. Add put_device() in the else branch immediately after child_dev is no longer needed. As the comment of device_find_any_child states: "NOTE: you will need to drop the reference with put_device() after use". Found by code review. Cc: stable@vger.kernel.org Fixes: 26409dd04589 ("of: unittest: Add pci_dt_testdrv pci driver") Signed-off-by: Ma Ke Signed-off-by: Rob Herring (Arm)