Re: [PATCH v3 11/20] pmdomain: imx: use platform_device_set_of_node()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Child platform devices dynamically added during probe are not unregistered on probe error paths or during driver removal.
- [High] The i.MX GPC power domain driver initializes domains as powered on but does not set GENPD_FLAG_NO_STAY_ON or provide a sync_state callback, causing domains to stay on indefinitely.
--

commit 183445e8048cfd412f98719fae14416614f14176
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

pmdomain: imx: use platform_device_set_of_node()

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

> diff --git a/drivers/pmdomain/imx/gpc.c b/drivers/pmdomain/imx/gpc.c
> index 42e50c9b4fb9f..abca5f449a226 100644
> --- a/drivers/pmdomain/imx/gpc.c
> +++ b/drivers/pmdomain/imx/gpc.c
> @@ -487,8 +487,7 @@ static int imx_gpc_probe(struct platform_device *pdev)
>  			domain->ipg_rate_mhz = ipg_rate_mhz;
>  
>  			pd_pdev->dev.parent = &pdev->dev;
> -			pd_pdev->dev.of_node = of_node_get(np);
> -			pd_pdev->dev.fwnode = of_fwnode_handle(np);
> +			platform_device_set_of_node(pd_pdev, np);
>  
>  			ret = platform_device_add(pd_pdev);
>  			if (ret) {

[Severity: High]
This isn't a bug introduced by this patch, but I noticed that child platform
devices added in previous loop iterations are not unregistered on this error
path.

If platform_device_add() fails, or if platform_device_alloc() fails earlier
in the loop, imx_gpc_probe() returns immediately. Any successfully added
"imx-pgc-power-domain" devices from previous iterations are left orphaned.

Because these orphaned child devices hold references to the parent's
devm-managed regmap, does this create a use-after-free when the parent's
devres cleanup runs?

The same unregistering step appears to be missing in imx_gpc_remove(), which
skips the cleanup of these dynamically added platform devices entirely when
pgc_node is present.

[Severity: High]
This is also a pre-existing issue, but I noticed a potential problem with how
these domains are initialized.

In imx_pgc_power_domain_probe(), the domains are initialized as powered on
via pm_genpd_init(&domain->base, NULL, false). For OF-based genpd providers,
this sets genpd->stay_on = true.

However, neither imx_gpc_driver nor imx_pgc_power_domain_driver registers a
.sync_state callback, and the domains do not have GENPD_FLAG_NO_STAY_ON set.

Since the stay_on flag is never cleared, will this cause the domains to
remain powered on indefinitely? If regulator_late_cleanup() later disables
the underlying regulators while the domains are still active, could this
lead to hardware malfunctions?

>  				platform_device_put(pd_pdev);
>  				return ret;
>  			}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706-pdev-fwnode-ref-v3-0-1ff028e33779@oss.qualcomm.com?part=11