[PATCH net] net: airoha: fix potential use-after-free in airoha_npu_get()
Alok Tiwari
alok.a.tiwari at oracle.com
Mon Jul 14 10:57:17 PDT 2025
np->name was being used after calling of_node_put(np), which
releases the node and can lead to a use-after-free bug.
Store the name in a local variable before releasing the
node to avoid potential issues.
Fixes: 23290c7bc190 ("net: airoha: Introduce Airoha NPU support")
Signed-off-by: Alok Tiwari <alok.a.tiwari at oracle.com>
---
drivers/net/ethernet/airoha/airoha_npu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/airoha/airoha_npu.c b/drivers/net/ethernet/airoha/airoha_npu.c
index 0e5b8c21b9aa8..30cd617232244 100644
--- a/drivers/net/ethernet/airoha/airoha_npu.c
+++ b/drivers/net/ethernet/airoha/airoha_npu.c
@@ -400,11 +400,12 @@ struct airoha_npu *airoha_npu_get(struct device *dev, dma_addr_t *stats_addr)
if (!np)
return ERR_PTR(-ENODEV);
+ const char *np_name = np->name;
pdev = of_find_device_by_node(np);
of_node_put(np);
if (!pdev) {
- dev_err(dev, "cannot find device node %s\n", np->name);
+ dev_err(dev, "cannot find device node %s\n", np_name);
return ERR_PTR(-ENODEV);
}
--
2.46.0
More information about the Linux-mediatek
mailing list