Re: [PATCH 5/8] pmdomain: imx: use platform_device_set_fwnode()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing leak of dynamically added child `platform_device`s on probe error or unbind, leading to use-after-free of parent's devm-managed resources.
--

--- Patch [5]: [PATCH 5/8] pmdomain: imx: use platform_device_set_fwnode() ---
commit 4ab43e8055c75d8cfe06f1c383c67f571e59d263
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

pmdomain: imx: use platform_device_set_fwnode()

This commit updates the driver to prefer the higher-level
platform_device_set_fwnode() over the OF-specific
platform_device_set_of_node() for dynamically allocated platform devices.

> diff --git a/drivers/pmdomain/imx/gpc.c b/drivers/pmdomain/imx/gpc.c
> --- a/drivers/pmdomain/imx/gpc.c
> +++ b/drivers/pmdomain/imx/gpc.c
> @@ -487,7 +487,7 @@ static int imx_gpc_probe(struct platform_device *pdev)
>  			domain->ipg_rate_mhz = ipg_rate_mhz;
>  
>  			pd_pdev->dev.parent = &pdev->dev;
> -			platform_device_set_of_node(pd_pdev, np);
> +			platform_device_set_fwnode(pd_pdev, of_fwnode_handle(np));
>  
>  			ret = platform_device_add(pd_pdev);
>  			if (ret) {
>  				platform_device_put(pd_pdev);
>  				return ret;
>  			}

[Severity: High]
This isn't a bug introduced by this patch, but does this error path leave
previously added child platform devices registered?

In imx_gpc_probe(), the child imx-pgc-power-domain platform devices are
added in a loop. If a subsequent iteration fails and returns here, it
triggers devres cleanup for the parent device, freeing resources like
the devm-managed regmap.

Because the previously added child devices are not unregistered on this
error path, will they remain bound with a dangling domain->regmap pointer?

Additionally, looking at imx_gpc_remove(), it entirely omits child
unregistration when the new DT binding is used, leaving the child
devices registered while parent devm resources are torn down:

drivers/pmdomain/imx/gpc.c:imx_gpc_remove() {
    ...
		}
	}

	of_node_put(pgc_node);
}

Could this also lead to a similar use-after-free of the regmap struct
on an explicit sysfs unbind?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-pdev-set-fwnode-instead-of-of-node-v1-0-2dee93f42c54@oss.qualcomm.com?part=5