Re: [PATCH 01/23] mfd: tps6586x: fix OF node refcount

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The IRQ domain and descriptors allocated in `tps6586x_irq_init()` are never freed, leading to a memory leak and potential use-after-free.
--

commit e8eb8e919be10c86b0019b03f67b4c7e8f91a6b2
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

mfd: tps6586x: fix OF node refcount

This commit fixes an OF node reference count issue for sub-devices
created with the split platform_device_alloc() and platform_device_add()
approach. It adds a missing of_node_get() to prevent a premature
of_node_put() during device release.

> diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
> index 8d5fe2b60bfa5..f5f8054466033 100644
> --- a/drivers/mfd/tps6586x.c
> +++ b/drivers/mfd/tps6586x.c
> @@ -397,7 +397,7 @@ static int tps6586x_add_subdevs(struct tps6586x *tps6586x,
>  
>  		pdev->dev.parent = tps6586x->dev;
>  		pdev->dev.platform_data = subdev->platform_data;
> -		pdev->dev.of_node = subdev->of_node;
> +		pdev->dev.of_node = of_node_get(subdev->of_node);
>  
>  		ret = platform_device_add(pdev);
>  		if (ret) {

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing this file I
noticed the IRQ domain and descriptors allocated in tps6586x_irq_init() are
never freed.

Does this driver leak the IRQ domain and descriptors on driver unbind
(tps6586x_i2c_remove()) or probe error paths?

tps6586x_irq_init() allocates descriptors using irq_alloc_descs() and creates
an IRQ domain via irq_domain_create_simple(). The driver lacks matching calls
to irq_domain_remove() and irq_free_descs(), and these allocations are not
managed by devm_ variants.

Since tps6586x is allocated via devm_kzalloc(), it is automatically freed
when the device unbinds or probe fails. If the leaked irq_domain remains
linked in the global irq_domain_list with its host_data pointing to the
freed tps6586x structure, can a subsequent traversal of the IRQ domains
(e.g., via /sys/kernel/debug/irq/domains) cause a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=1