Re: [PATCH v5 1/3] misc: fastrpc: iterate CB nodes manually instead of of_platform_populate

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] of: double-free of device_node references in OF iterator loops
- [Medium] driver-core: memory leak of platform_device in fastrpc_cb_devices_destroy
--

commit 0cd61e434e0b0defac9c431333bfa40bb39df800
Author: Vinayak Katoch <vinayak.katoch@oss.qualcomm.com>

misc: fastrpc: iterate CB nodes manually instead of of_platform_populate

This commit replaces of_platform_populate() with direct iteration over child 
context bank nodes to ensure synchronous initialization via fastrpc_cb_init().
It also introduces fastrpc_cb_devices_destroy() to manually clean up platform 
devices during teardown and removes the standalone platform driver.

> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> index af18ff1992eed..f20d3e5ecc81f 100644
> --- a/drivers/misc/fastrpc.c
> +++ b/drivers/misc/fastrpc.c
[ ... ]
> @@ -2389,37 +2389,63 @@ static int fastrpc_cb_probe(struct platform_device *pdev)
> -static void fastrpc_cb_remove(struct platform_device *pdev)
> +static void fastrpc_cb_devices_destroy(struct rpmsg_device *rpdev)
>  {
[ ... ]
> +	for_each_available_child_of_node(rdev->of_node, np) {
> +		if (!of_device_is_compatible(np, "qcom,fastrpc-compute-cb")) {
> +			of_node_put(np);
> +			continue;
>  		}

[Severity: High]
Does explicitly dropping the reference before continue result in a double-free
when the loop macro advances? The for_each_available_child_of_node() iterator
inherently calls of_node_put() on the previous node when advancing. This
occurs here during device destruction in fastrpc_cb_devices_destroy().

> +
> +		pdev = of_find_device_by_node(np);
> +		of_node_put(np);

[Severity: High]
Does explicitly dropping the reference at the end of the loop body result in a
double-free when the loop macro advances to the next iteration?

> +		if (pdev)
> +			of_platform_device_destroy(&pdev->dev, NULL);
>  	}

[Severity: Medium]
Does this leak the platform_device reference acquired by
of_find_device_by_node() in fastrpc_cb_devices_destroy()? The reference
returned by of_find_device_by_node() has an incremented reference count, which
doesn't appear to be released via put_device() or platform_device_put() after
unregistering the device.

> -	spin_unlock_irqrestore(&cctx->lock, flags);
>  }
>  
[ ... ]
> +static int fastrpc_cb_devices_create(struct rpmsg_device *rpdev)
> +{
> +	struct device *rdev = &rpdev->dev;
> +	struct platform_device *pdev;
> +	struct device_node *np;
> +	int err;
>  
> +	for_each_available_child_of_node(rdev->of_node, np) {
> +		if (!of_device_is_compatible(np, "qcom,fastrpc-compute-cb")) {
> +			of_node_put(np);
> +			continue;
> +		}

[Severity: High]
Does explicitly dropping the reference before continue result in a double-free
when the loop macro advances? The for_each_available_child_of_node() iterator
inherently calls of_node_put() on the previous node when advancing. This
occurs during driver initialization in fastrpc_cb_devices_create().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923-dup-sessions-v5-0-e953133a1827@oss.qualcomm.com?part=1