Re: [PATCH 1/2] ARM: imx: fix device_node refcount leak in imx_src_init()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the `imx_src_probe()` platform driver blindly registers the reset controller without verifying if the global `src_base` pointer was successfully initialized.
--

commit 3a8b3e9f6b1a902d26351b0e93daa81ca748d342
Author: Weigang He <geoffreyhe2@gmail.com>

ARM: imx: fix device_node refcount leak in imx_src_init()

imx_src_init() obtains a device_node reference via
of_find_compatible_node() matching "fsl,imx51-src" and uses it only to
call of_iomap(). It never releases that reference: on the success path
the function returns at the end without of_node_put(np), leaking one
device_node refcount on every boot of an i.MX5/6 platform.

> diff --git a/arch/arm/mach-imx/src.c b/arch/arm/mach-imx/src.c
> index 59a8e8cc44693..f28bfb653a88f 100644
> --- a/arch/arm/mach-imx/src.c
> +++ b/arch/arm/mach-imx/src.c
> @@ -171,6 +171,7 @@ void __init imx_src_init(void)
>  	if (!np)
>  		return;
>  	src_base = of_iomap(np, 0);
> +	of_node_put(np);
>  	WARN_ON(!src_base);

[Severity: High]
This isn't a bug introduced by this patch, but the imx_src_probe() platform
driver blindly registers the reset controller without verifying if the global
src_base pointer was successfully initialized.

On platforms like i.MX50, the early boot initialization function
imx_src_init() is never called, leaving src_base statically uninitialized
(NULL).

Despite src_base being NULL, the i.MX50 device tree contains the
"fsl,imx51-src" compatible string, which causes imx_src_probe() to execute
and register the reset controller:

arch/arm/mach-imx/src.c:imx_src_probe() {
    ...
	rcdev->ops = &imx_src_ops;
	rcdev->dev = &pdev->dev;
	rcdev->of_node = pdev->dev.of_node;
	rcdev->nr_resets = ARRAY_SIZE(sw_reset_bits);

	return devm_reset_controller_register(&pdev->dev, rcdev);
}

Any subsequent consumer request for a reset via the API will trigger a
structurally guaranteed kernel panic on a NULL pointer dereference because
imx_src_reset_module() unconditionally dereferences src_base.

Should the probe function verify if (!src_base) before registering the
controller to avoid exposing a fatally broken API?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260610050625.2229221-1-geoffreyhe2@gmail.com?part=1