[PATCH] interconnect: imx: fix use-after-free in imx_icc_node_init_qos()

[Frank Li]

On Wed, Apr 08, 2026 at 03:10:04AM +0000, Wentao Liang wrote:
> Move of_node_put(dn) after the last use of dn, and add a missing put
> in the error path to avoid both use-after-free and reference leak.
>
> Fixes: f0d8048525d7 ("interconnect: Add imx core driver")
> Cc: stable at vger.kernel.org
> Signed-off-by: Wentao Liang <vulab at iscas.ac.cn>
> ---
>  drivers/interconnect/imx/imx.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/interconnect/imx/imx.c b/drivers/interconnect/imx/imx.c
> index 9511f80cf041..75431b5ccef8 100644
> --- a/drivers/interconnect/imx/imx.c
> +++ b/drivers/interconnect/imx/imx.c
> @@ -143,15 +143,16 @@ static int imx_icc_node_init_qos(struct icc_provider *provider,
>  		}
>

Please use auto cleanup to fix this problem

struct device_node * __free(device_nod) dn = of_parse_phandle(dev->of_node, adj->phandle_name, 0);

Frank
>  		pdev = of_find_device_by_node(dn);
> -		of_node_put(dn);
>  		if (!pdev) {
>  			dev_warn(dev, "node %s[%d] missing device for %pOF\n",
>  				 node->name, node->id, dn);
> +			of_node_put(dn);
>  			return -EPROBE_DEFER;
>  		}
>  		node_data->qos_dev = &pdev->dev;
>  		dev_dbg(dev, "node %s[%d] has device node %pOF\n",
>  			node->name, node->id, dn);
> +		of_node_put(dn);
>  	}
>
>  	return dev_pm_qos_add_request(node_data->qos_dev,
> --
> 2.34.1
>