[PATCH 00/23] driver core: count references of the platform device's fwnode, not OF node

[PATCH 00/23] driver core: count references of the platform device's fwnode, not OF node

[Bartosz Golaszewski]

I'd like to first apologize for the long, treewide series and an
extensive Cc list but I think it's important to show the big picture and
the end result of this rework.

Platform device core provides helper interfaces for dealing with
dynamically created platform devices. Most users should use
platform_device_register_full() which encapsulates most of the
operations but some modules will want to use the split approach of
calling platform_device_alloc() + platform_device_add() separately for
various reasons.

With many platform devices now using dynamic software nodes as their
primary firmware nodes and with the platform device interface being
extended to also better cover the use-cases of secondary software nodes,
I believe it makes sense to switch to counting the references of all
kinds of firmware nodes.

To that end, I identified all users of platform_device_alloc() that also
assign dev.of_node or dev.fwnode manually. I noticed five cases where
the references are not increased as they should (patches 1-5 fix these
users) and provided three new functions in platform_device.h that now
become the preferred interfaces for assigning firmware nodes to dynamic
platform devices (in line with platform_device_add_data(),
platform_device_add_resources(), etc.). The bulk of the patches in this
series are small driver conversions to port all users to going through
the new functions that now encapsulate the refcount logic. With that
done, the final patch seamlessly switches to counting the references of
all firmware node types.

This effort is prerequisite of removing platform_device_release_full()
and unifying the release path for dynamic platform devices using
unmanaged software nodes.

Merging strategy: First tree patches should go directly into individual
maintainers' trees and land in v7.1 and stable as bug fixes. The
remaining patches touch lots of drivers but the changes are minimal and
unlikely to cause any conflicts. I believe they should be queued in the
driver core tree for v7.2 (possibly on an immutable branch for others to
merge into their trees). If the subsystem maintainers object, the
alternative is to queue the three new helpers for platform devices via
the driver core tree. After v7.2-rc1, I'd resend individual driver
patches to appropriate maintainers and once they're upstream, we can
apply the final platform device change. However this would take three
cycles to complete so my preference is the former solution.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
Bartosz Golaszewski (23):
      mfd: tps6586x: fix OF node refcount
      net: mv643xx: fix OF node refcount
      slimbus: qcom-ngd-ctrl: fix OF node refcount
      pmdomain: imx: fix OF node refcount
      powerpc/powermac: fix OF node refcount
      driver core: platform: provide platform_device_set_of_node()
      driver core: platform: provide platform_device_set_fwnode()
      driver core: platform: provide platform_device_set_of_node_from_dev()
      of: platform: use platform_device_set_of_node()
      powerpc/powermac: use platform_device_set_of_node()
      i2c: pxa-pci: use platform_device_set_of_node()
      iommu/fsl: use platform_device_set_of_node()
      net: bcmgenet: use platform_device_set_of_node()
      pmdomain: imx: use platform_device_set_of_node()
      mfd: tps6586: use platform_device_set_of_node()
      slimbus: qcom-ngd-ctrl: use platform_device_set_of_node()
      net: mv643xx: use platform_device_set_of_node()
      drm/xe/i2c: use platform_device_set_fwnode()
      platform/surface: gpe: use platform_device_set_fwnode()
      usb: chipidea: use platform_device_set_of_node_from_dev()
      usb: musb: use platform_device_set_of_node_from_dev()
      reset: rzg2l: use platform_device_set_of_node_from_dev()
      driver core: platform: count references to all kinds of firmware nodes

 arch/powerpc/platforms/powermac/low_i2c.c    |  2 +-
 drivers/base/platform.c                      | 56 ++++++++++++++++++++++++++--
 drivers/gpu/drm/xe/xe_i2c.c                  |  2 +-
 drivers/i2c/busses/i2c-pxa-pci.c             |  3 +-
 drivers/iommu/fsl_pamu.c                     |  7 ++--
 drivers/mfd/tps6586x.c                       |  2 +-
 drivers/net/ethernet/broadcom/genet/bcmmii.c | 10 +++--
 drivers/net/ethernet/marvell/mv643xx_eth.c   |  2 +-
 drivers/of/platform.c                        |  2 +-
 drivers/platform/surface/surface_gpe.c       |  2 +-
 drivers/pmdomain/imx/gpc.c                   |  3 +-
 drivers/reset/reset-rzg2l-usbphy-ctrl.c      |  2 +-
 drivers/slimbus/qcom-ngd-ctrl.c              |  2 +-
 drivers/usb/chipidea/core.c                  |  2 +-
 drivers/usb/musb/jz4740.c                    |  2 +-
 include/linux/platform_device.h              |  8 ++++
 16 files changed, 84 insertions(+), 23 deletions(-)
---
base-commit: 687da68900cd1a46549f7d9430c7d40346cb86a0
change-id: 20260520-pdev-fwnode-ref-d867836971eb

Best regards,
-- 
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

[PATCH 01/23] mfd: tps6586x: fix OF node refcount

[Bartosz Golaszewski]

Platform devices created with platform_device_alloc() call
platform_device_release() when the last reference to the device's
kobject is dropped. This function calls of_node_put() unconditionally.
This works fine for devices created with platform_device_register_full()
but users of the split approach (platform_device_alloc() +
platform_device_add()) must bump the reference of the of_node they
assign manually. Add the missing call to of_node_get().

Cc: stable@vger.kernel.org
Fixes: 62f6b0879304 ("tps6586x: Add device tree support")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/mfd/tps6586x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
index 8d5fe2b60bfa550d0aad30acd0820fac354028ac..f5f805446603315ba76ce1fc501c908f1cec0d16 100644
--- a/drivers/mfd/tps6586x.c
+++ b/drivers/mfd/tps6586x.c
@@ -397,7 +397,7 @@ static int tps6586x_add_subdevs(struct tps6586x *tps6586x,
 
 		pdev->dev.parent = tps6586x->dev;
 		pdev->dev.platform_data = subdev->platform_data;
-		pdev->dev.of_node = subdev->of_node;
+		pdev->dev.of_node = of_node_get(subdev->of_node);
 
 		ret = platform_device_add(pdev);
 		if (ret) {

-- 
2.47.3

Re: (subset) [PATCH 01/23] mfd: tps6586x: fix OF node refcount

[Lee Jones]

On Thu, 21 May 2026 10:36:24 +0200, Bartosz Golaszewski wrote:
> Platform devices created with platform_device_alloc() call
> platform_device_release() when the last reference to the device's
> kobject is dropped. This function calls of_node_put() unconditionally.
> This works fine for devices created with platform_device_register_full()
> but users of the split approach (platform_device_alloc() +
> platform_device_add()) must bump the reference of the of_node they
> assign manually. Add the missing call to of_node_get().
> 
> [...]

Applied, thanks!

[01/23] mfd: tps6586x: fix OF node refcount
        commit: 60a28e85ba5c0707b743857a3304107f2f9d0482

--
Lee Jones [李琼斯]

Re: [PATCH 01/23] mfd: tps6586x: fix OF node refcount

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The IRQ domain and descriptors allocated in `tps6586x_irq_init()` are never freed, leading to a memory leak and potential use-after-free.
--

commit e8eb8e919be10c86b0019b03f67b4c7e8f91a6b2
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

mfd: tps6586x: fix OF node refcount

This commit fixes an OF node reference count issue for sub-devices
created with the split platform_device_alloc() and platform_device_add()
approach. It adds a missing of_node_get() to prevent a premature
of_node_put() during device release.

> diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
> index 8d5fe2b60bfa5..f5f8054466033 100644
> --- a/drivers/mfd/tps6586x.c
> +++ b/drivers/mfd/tps6586x.c
> @@ -397,7 +397,7 @@ static int tps6586x_add_subdevs(struct tps6586x *tps6586x,
>  
>  		pdev->dev.parent = tps6586x->dev;
>  		pdev->dev.platform_data = subdev->platform_data;
> -		pdev->dev.of_node = subdev->of_node;
> +		pdev->dev.of_node = of_node_get(subdev->of_node);
>  
>  		ret = platform_device_add(pdev);
>  		if (ret) {

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing this file I
noticed the IRQ domain and descriptors allocated in tps6586x_irq_init() are
never freed.

Does this driver leak the IRQ domain and descriptors on driver unbind
(tps6586x_i2c_remove()) or probe error paths?

tps6586x_irq_init() allocates descriptors using irq_alloc_descs() and creates
an IRQ domain via irq_domain_create_simple(). The driver lacks matching calls
to irq_domain_remove() and irq_free_descs(), and these allocations are not
managed by devm_ variants.

Since tps6586x is allocated via devm_kzalloc(), it is automatically freed
when the device unbinds or probe fails. If the leaked irq_domain remains
linked in the global irq_domain_list with its host_data pointing to the
freed tps6586x structure, can a subsequent traversal of the IRQ domains
(e.g., via /sys/kernel/debug/irq/domains) cause a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=1

[PATCH 02/23] net: mv643xx: fix OF node refcount

[Bartosz Golaszewski]

Platform devices created with platform_device_alloc() call
platform_device_release() when the last reference to the device's
kobject is dropped. This function calls of_node_put() unconditionally.
This works fine for devices created with platform_device_register_full()
but users of the split approach (platform_device_alloc() +
platform_device_add()) must bump the reference of the of_node they
assign manually. Add the missing call to of_node_get().

Cc: stable@vger.kernel.org
Fixes: 76723bca2802 ("net: mv643xx_eth: add DT parsing support")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index f9055b3d6fb102ebc695dce9c6c8321889a78dfa..1881583be5ce2e972fceb14c2b8348280c49ad1d 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -2780,7 +2780,7 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev,
 		goto put_err;
 	}
 	ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
-	ppdev->dev.of_node = pnp;
+	ppdev->dev.of_node = of_node_get(pnp);
 
 	ret = platform_device_add_resources(ppdev, &res, 1);
 	if (ret)

-- 
2.47.3

[PATCH 03/23] slimbus: qcom-ngd-ctrl: fix OF node refcount

[Bartosz Golaszewski]

Platform devices created with platform_device_alloc() call
platform_device_release() when the last reference to the device's
kobject is dropped. This function calls of_node_put() unconditionally.
This works fine for devices created with platform_device_register_full()
but users of the split approach (platform_device_alloc() +
platform_device_add()) must bump the reference of the of_node they
assign manually. Add the missing call to of_node_get().

Cc: stable@vger.kernel.org
Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/slimbus/qcom-ngd-ctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 1ed6be6e85d2cfc0a2b65a5ae24f666de922c89d..428266949fdd07ac13c5553bded891225c6e1a16 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1542,7 +1542,7 @@ static int of_qcom_slim_ngd_register(struct device *parent,
 			kfree(ngd);
 			return ret;
 		}
-		ngd->pdev->dev.of_node = node;
+		ngd->pdev->dev.of_node = of_node_get(node);
 		ctrl->ngd = ngd;
 
 		ret = platform_device_add(ngd->pdev);

-- 
2.47.3

Re: [PATCH 03/23] slimbus: qcom-ngd-ctrl: fix OF node refcount

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 8 potential issue(s) to consider:

Pre-existing issues:
- [High] Probe error path bypasses cleanup, leaking PDR handle, SSR notifier, and leading to Use-After-Free.
- [High] The dynamically allocated child platform device is never unregistered upon module removal or driver unbind.
- [High] Hardware interrupt handler is registered before underlying structures are fully initialized.
- [High] Unsafe registration of the global platform driver within the controller's probe function.
- [High] Unchecked dereference of `of_match_node()` return value leads to a potential NULL pointer dereference.
- [High] SSR notifier can execute before work_struct initialization, causing a kernel crash.
- [High] Missing cancellation of `ngd_up_work` during device removal causes a Use-After-Free.
- [High] DMA coherent memory is leaked on every suspend/resume cycle.
--

commit a849bb0b2b8baaf7273c84580d82b6ab6bc55f3a
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

slimbus: qcom-ngd-ctrl: fix OF node refcount

This commit fixes an OF node reference counting issue when using the split
approach for platform device creation. It adds a missing call to of_node_get()
before platform_device_add(), preventing an unbalanced of_node_put() when the
platform device is released.

> diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
> index 1ed6be6e85d2c..428266949fdd0 100644
> --- a/drivers/slimbus/qcom-ngd-ctrl.c
> +++ b/drivers/slimbus/qcom-ngd-ctrl.c
> @@ -1542,7 +1542,7 @@ static int of_qcom_slim_ngd_register(struct device *parent,

[Severity: High]
This isn't a bug introduced by this patch, but in of_qcom_slim_ngd_register(),
the result of of_match_node() is immediately dereferenced.

If the parent device lacks a valid of_node (for example, if it is instantiated
manually or bound via sysfs), the match variable will be NULL. Could this
cause a kernel panic?

>  			kfree(ngd);
>  			return ret;
>  		}
> -		ngd->pdev->dev.of_node = node;
> +		ngd->pdev->dev.of_node = of_node_get(node);
>  		ctrl->ngd = ngd;
>  
>  		ret = platform_device_add(ngd->pdev);

[Severity: High]
This is a pre-existing issue, but of_qcom_slim_ngd_register() dynamically
allocates and adds a child platform device (ngd->pdev).

Do the controller removal function or the child device's unbind path ever
call platform_device_unregister() for this device?

If not, doesn't this cause memory and device leaks, permanently leak the
of_node reference, and prevent module reloading due to sysfs name collisions
in platform_device_add()?

[Severity: High]
This is a pre-existing issue, but if of_qcom_slim_ngd_register() fails, does
the probe function return the error directly and bypass the err_pdr_alloc and
err_pdr_lookup cleanup labels?

This would leave the SSR notifier registered. Because ctrl is managed by
devm_kzalloc(), it is freed upon probe failure. If the SSR notifier later
fires, won't it access the freed ctrl structure and lead to a Use-After-Free?
Additionally, are the cleanup labels incorrectly ordered?

[Severity: High]
This isn't a bug introduced by this patch, but in qcom_slim_ngd_ctrl_probe(),
devm_request_irq() registers qcom_slim_ngd_interrupt() before ctrl->ngd and
ctrl->ctrl.dev are assigned in the subsequent registration steps.

Could an early or spurious interrupt dereference these NULL pointers and lead
to a kernel panic?

[Severity: High]
This is a pre-existing issue, but platform_driver_register() is called for
qcom_slim_ngd_driver directly inside the controller's probe function.

Doesn't this break driver model semantics? If multiple controller instances
exist, subsequent registrations would fail. When any single controller
instance is removed, qcom_slim_ngd_ctrl_remove() unregisters this global
driver. Wouldn't that forcibly unbind all child devices across all active
controller instances?

[Severity: High]
This is a pre-existing issue, but the SSR notifier is registered in
qcom_slim_ngd_ctrl_probe() before the child device's probe function
initializes the ngd_up_work structure via INIT_WORK().

If the service is already UP, won't the notifier callback fire immediately
and call schedule_work(&ctrl->ngd_up_work) on a zero-initialized
work_struct, leading to a kernel crash?

[Severity: High]
This isn't a bug introduced by this patch, but the driver appears to fail to
call cancel_work_sync(&ctrl->ngd_up_work) in its remove path.

If an SSR event schedules this work on the system workqueue right before the
device is removed, wouldn't the work remain pending and execute after devm
has freed the ctrl structure, causing a Use-After-Free?

[Severity: High]
This is a pre-existing issue, but qcom_slim_ngd_init_dma() allocates DMA
memory for ctrl->rx_base and ctrl->tx_base using dma_alloc_coherent(), which
runs during setup and runtime resume.

However, the teardown function qcom_slim_ngd_exit_dma() only terminates the
DMA channels and never calls dma_free_coherent(). Doesn't this lead to a
repeated DMA memory leak on every suspend/resume cycle?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=3

[PATCH 04/23] pmdomain: imx: fix OF node refcount

[Bartosz Golaszewski]

for_each_child_of_node_scoped() decrements the reference count of the
nod after each iteration. Assigning it without incrementing the refcount
to a dynamically allocated platform device will result in a double put
in platform_device_release(). Add the missing call to of_node_get().

Cc: stable@vger.kernel.org
Fixes: 3e4d109ee8fc ("pmdomain: imx: gpc: Simplify with scoped for each OF child loop")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/pmdomain/imx/gpc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pmdomain/imx/gpc.c b/drivers/pmdomain/imx/gpc.c
index de695f1944ab31de3d37ce8000d0c577579d64f9..42e50c9b4fb9ffb96a20a462d4eb5168942a893c 100644
--- a/drivers/pmdomain/imx/gpc.c
+++ b/drivers/pmdomain/imx/gpc.c
@@ -487,7 +487,7 @@ static int imx_gpc_probe(struct platform_device *pdev)
 			domain->ipg_rate_mhz = ipg_rate_mhz;
 
 			pd_pdev->dev.parent = &pdev->dev;
-			pd_pdev->dev.of_node = np;
+			pd_pdev->dev.of_node = of_node_get(np);
 			pd_pdev->dev.fwnode = of_fwnode_handle(np);
 
 			ret = platform_device_add(pd_pdev);

-- 
2.47.3

Re: [PATCH 04/23] pmdomain: imx: fix OF node refcount

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:

Pre-existing issues:
- [High] Child platform devices dynamically created during probe are not unregistered on error or driver removal, leading to device leaks, memory leaks, and a use-after-free of the devres-managed regmap.
- [High] Power domains initialized as 'on' remain powered indefinitely due to missing `sync_state` callback and missing `GENPD_FLAG_NO_STAY_ON` flag.
- [High] Missing lower bound check on the signed `domain_index` variable can lead to an array out-of-bounds read.
- [High] A potential divide-by-zero kernel panic when calculating the power-off delay if the IPG clock rate is less than 1 MHz.
--

commit b02126ed3cd782919c6e44b786dd9f03cbf6fa28
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

pmdomain: imx: fix OF node refcount

This commit fixes a double put in platform_device_release() by adding
a missing call to of_node_get() when assigning the OF node to a
dynamically allocated platform device in imx_gpc_probe().

> diff --git a/drivers/pmdomain/imx/gpc.c b/drivers/pmdomain/imx/gpc.c
> index de695f1944ab3..42e50c9b4fb9f 100644
> --- a/drivers/pmdomain/imx/gpc.c
> +++ b/drivers/pmdomain/imx/gpc.c
> @@ -487,7 +487,7 @@ static int imx_gpc_probe(struct platform_device *pdev)

[Severity: High]
This is a pre-existing issue, but is there a missing sync_state
callback or GENPD_FLAG_NO_STAY_ON flag for these power domains?

The domains initialized as 'on' (with is_off = false in
pm_genpd_init()) have genpd->stay_on = true set by the genpd
subsystem. This flag prevents the domains from being powered off until
it is cleared.

Typically, a provider's sync_state callback clears this flag, but
neither imx_gpc_driver nor imx_pgc_power_domain_driver appear to
implement .sync_state. The driver also lacks the
GENPD_FLAG_NO_STAY_ON opt-out flag.

Could this cause unused power domains to remain powered on forever,
potentially leading to hardware issues when late regulator cleanups
disable regulators supplying these forced-on domains?

[Severity: High]
This isn't a bug introduced by this patch, but does the domain_index
validation adequately protect against negative values?

Earlier in the function, of_property_read_u32() reads a 32-bit
unsigned value from the device tree reg property into the memory of
domain_index, which is declared as a signed int. Input values
with the most significant bit set (>= 0x80000000) are interpreted
as negative numbers.

The upper bound check uses a signed comparison:

    if (domain_index >= of_id_data->num_domains)

which evaluates to false for negative numbers. Can this bypass the
validation and result in an out-of-bounds memory address computation
for &imx_gpc_domains[domain_index] when it is passed to
platform_device_add_data()?

>  			domain->ipg_rate_mhz = ipg_rate_mhz;

[Severity: High]
This is a pre-existing issue, but could the truncation of
ipg_rate_mhz lead to a divide-by-zero panic?

The ipg clock rate is calculated earlier using:

    ipg_rate_mhz = clk_get_rate(ipg_clk) / 1000000;

If the clock rate is less than 1,000,000 Hz, the integer division
truncates ipg_rate_mhz to 0.

Later, imx6_pm_domain_power_off() calculates a delay using:

    DIV_ROUND_UP(iso + iso2sw, pd->ipg_rate_mhz)

Since DIV_ROUND_UP(n, d) divides by the denominator, would passing
a denominator of 0 cause an immediate kernel panic when the system
attempts to turn off the power domain?

>  
>  			pd_pdev->dev.parent = &pdev->dev;
> -			pd_pdev->dev.of_node = np;
> +			pd_pdev->dev.of_node = of_node_get(np);
>  			pd_pdev->dev.fwnode = of_fwnode_handle(np);
>  
>  			ret = platform_device_add(pd_pdev);

[Severity: High]
This isn't a bug introduced by this patch, but are the dynamically
created child platform devices properly unregistered if
platform_device_add() fails?

The child platform devices (pd_pdev) are allocated and added within a
loop. If platform_device_add() fails on a subsequent iteration, the
function returns immediately without unregistering the previously added
child devices.

Similarly, imx_gpc_remove() does not unregister these devices when
the driver is unbound if the newer device tree binding is used (pgc_node
is present).

When the parent device is unbound or fails to probe, the devres
framework automatically frees its regmap. Because the leaked child
devices still hold a reference to this regmap (domain->regmap),
would any subsequent interaction with them trigger a use-after-free?

Furthermore, does the missing unregister path now permanently leak the
acquired of_node_get() references introduced in this patch?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=4

[PATCH 05/23] powerpc/powermac: fix OF node refcount

[Bartosz Golaszewski]

Platform devices created with platform_device_alloc() call
platform_device_release() when the last reference to the device's
kobject is dropped. This function calls of_node_put() unconditionally.
This works fine for devices created with platform_device_register_full()
but users of the split approach (platform_device_alloc() +
platform_device_add()) must bump the reference of the of_node they
assign manually. Add the missing call to of_node_get().

Cc: stable@vger.kernel.org
Fixes: 81e5d8646ff6 ("i2c/powermac: Register i2c devices from device-tree")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 arch/powerpc/platforms/powermac/low_i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/powermac/low_i2c.c b/arch/powerpc/platforms/powermac/low_i2c.c
index da72a30ab8657e6dc7e6f3437af612155783d8f9..973f58771d9636605ed5d3e91b45008543b584d3 100644
--- a/arch/powerpc/platforms/powermac/low_i2c.c
+++ b/arch/powerpc/platforms/powermac/low_i2c.c
@@ -1471,7 +1471,7 @@ static int __init pmac_i2c_create_platform_devices(void)
 		if (bus->platform_dev == NULL)
 			return -ENOMEM;
 		bus->platform_dev->dev.platform_data = bus;
-		bus->platform_dev->dev.of_node = bus->busnode;
+		bus->platform_dev->dev.of_node = of_node_get(bus->busnode);
 		platform_device_add(bus->platform_dev);
 	}
 

-- 
2.47.3

[PATCH 06/23] driver core: platform: provide platform_device_set_of_node()

[Bartosz Golaszewski]

Encapsulate the reference counting logic for OF nodes assigned to
platform devices created with platform_device_alloc() in a helper
function. Make the kerneldoc state that this is the proper interface for
assigning OF nodes to dynamically allocated platform devices. This will
allow us to switch to counting the references of the device's firmware
nodes, not only the OF nodes.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/base/platform.c         | 18 ++++++++++++++++++
 include/linux/platform_device.h |  3 +++
 2 files changed, 21 insertions(+)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 4824d9a2edbe9ff86cc9893cd74688e9cbb6483e..ec53383fa17ac29ea3b15b61f97ae65ae8ca22ac 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -693,6 +693,24 @@ int platform_device_add_data(struct platform_device *pdev, const void *data,
 }
 EXPORT_SYMBOL_GPL(platform_device_add_data);
 
+/**
+ * platform_device_set_of_node - assign an OF node to device
+ * @pdev: platform device to add the node for
+ * @np: new device node
+ *
+ * Assign an OF node to this platform device. Internally keep track of the
+ * reference count. Devices created with platform_device_alloc() must use this
+ * function instead of assigning the node manually.
+ */
+void platform_device_set_of_node(struct platform_device *pdev,
+				 struct device_node *np)
+{
+	of_node_put(pdev->dev.of_node);
+	pdev->dev.of_node = of_node_get(np);
+	pdev->dev.fwnode = of_fwnode_handle(np);
+}
+EXPORT_SYMBOL_GPL(platform_device_set_of_node);
+
 /**
  * platform_device_add - add a platform device to device hierarchy
  * @pdev: platform device we're adding
diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
index 975400a472e30e2f98cc8f13bc36a63129bd4fcf..21f7d8a7f4b5c9a47d56d80a69802b3f84457ef7 100644
--- a/include/linux/platform_device.h
+++ b/include/linux/platform_device.h
@@ -19,6 +19,7 @@ struct irq_affinity;
 struct mfd_cell;
 struct property_entry;
 struct platform_device_id;
+struct device_node;
 
 struct platform_device {
 	const char	*name;
@@ -262,6 +263,8 @@ extern int platform_device_add_resources(struct platform_device *pdev,
 					 unsigned int num);
 extern int platform_device_add_data(struct platform_device *pdev,
 				    const void *data, size_t size);
+void platform_device_set_of_node(struct platform_device *pdev,
+				 struct device_node *np);
 extern int platform_device_add(struct platform_device *pdev);
 extern void platform_device_del(struct platform_device *pdev);
 extern void platform_device_put(struct platform_device *pdev);

-- 
2.47.3

[PATCH 07/23] driver core: platform: provide platform_device_set_fwnode()

[Bartosz Golaszewski]

Provide a helper function encapsulating the logic of assigning firmware
nodes to platform devices created with platform_device_alloc(). Make the
kerneldoc state that this is the proper interface for assigning firmware
nodes to dynamically allocated platform devices. This will allow us to
switch to counting the references of the device's firmware nodes in the
future, not only the OF nodes.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/base/platform.c         | 19 +++++++++++++++++++
 include/linux/platform_device.h |  3 +++
 2 files changed, 22 insertions(+)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index ec53383fa17ac29ea3b15b61f97ae65ae8ca22ac..449914e657c9c58cbf030208e60583dde728d6c0 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -711,6 +711,25 @@ void platform_device_set_of_node(struct platform_device *pdev,
 }
 EXPORT_SYMBOL_GPL(platform_device_set_of_node);
 
+/**
+ * platform_device_set_fwnode - assign a firmware node to device
+ * @pdev: platform device to set the node for
+ * @fwnode: new firmware node
+ *
+ * Assign a firmware node to this platform device. Internally keep track of the
+ * reference count. Devices created with platform_device_alloc() must use this
+ * function instead of assigning the node manually.
+ */
+void platform_device_set_fwnode(struct platform_device *pdev,
+				struct fwnode_handle *fwnode)
+{
+	if (is_of_node(fwnode))
+		platform_device_set_of_node(pdev, to_of_node(fwnode));
+	else
+		pdev->dev.fwnode = fwnode;
+}
+EXPORT_SYMBOL_GPL(platform_device_set_fwnode);
+
 /**
  * platform_device_add - add a platform device to device hierarchy
  * @pdev: platform device we're adding
diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
index 21f7d8a7f4b5c9a47d56d80a69802b3f84457ef7..a915a6f2da71284b60a6595dfeb013ca0dba542e 100644
--- a/include/linux/platform_device.h
+++ b/include/linux/platform_device.h
@@ -20,6 +20,7 @@ struct mfd_cell;
 struct property_entry;
 struct platform_device_id;
 struct device_node;
+struct fwnode_handle;
 
 struct platform_device {
 	const char	*name;
@@ -265,6 +266,8 @@ extern int platform_device_add_data(struct platform_device *pdev,
 				    const void *data, size_t size);
 void platform_device_set_of_node(struct platform_device *pdev,
 				 struct device_node *np);
+void platform_device_set_fwnode(struct platform_device *pdev,
+				struct fwnode_handle *fwnode);
 extern int platform_device_add(struct platform_device *pdev);
 extern void platform_device_del(struct platform_device *pdev);
 extern void platform_device_put(struct platform_device *pdev);

-- 
2.47.3

[PATCH 08/23] driver core: platform: provide platform_device_set_of_node_from_dev()

[Bartosz Golaszewski]

Provide a platform-specific variant of device_set_of_node_from_dev(). In
addition to bumping the reference count of the OF node being assigned,
it also assigns the fwnode of the platform device.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/base/platform.c         | 16 ++++++++++++++++
 include/linux/platform_device.h |  2 ++
 2 files changed, 18 insertions(+)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 449914e657c9c58cbf030208e60583dde728d6c0..b14f707f077bcc535fff9484d1ec904616d0a1d1 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -730,6 +730,22 @@ void platform_device_set_fwnode(struct platform_device *pdev,
 }
 EXPORT_SYMBOL_GPL(platform_device_set_fwnode);
 
+/**
+ * platform_device_set_of_node_from_dev - reuse OF node of another device
+ * @pdev: platform device to set the node for
+ * @dev2: device whose OF node to reuse
+ *
+ * Reuses the OF node of another device in this platform device while
+ * internally keeping track of reference counting.
+ */
+void platform_device_set_of_node_from_dev(struct platform_device *pdev,
+					  const struct device *dev2)
+{
+	device_set_of_node_from_dev(&pdev->dev, dev2);
+	pdev->dev.fwnode = of_fwnode_handle(pdev->dev.of_node);
+}
+EXPORT_SYMBOL_GPL(platform_device_set_of_node_from_dev);
+
 /**
  * platform_device_add - add a platform device to device hierarchy
  * @pdev: platform device we're adding
diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
index a915a6f2da71284b60a6595dfeb013ca0dba542e..e5ca686f23998a3182a9573a7d1e84c6a6fcdafb 100644
--- a/include/linux/platform_device.h
+++ b/include/linux/platform_device.h
@@ -268,6 +268,8 @@ void platform_device_set_of_node(struct platform_device *pdev,
 				 struct device_node *np);
 void platform_device_set_fwnode(struct platform_device *pdev,
 				struct fwnode_handle *fwnode);
+void platform_device_set_of_node_from_dev(struct platform_device *pdev,
+					  const struct device *dev2);
 extern int platform_device_add(struct platform_device *pdev);
 extern void platform_device_del(struct platform_device *pdev);
 extern void platform_device_put(struct platform_device *pdev);

-- 
2.47.3

[PATCH 09/23] of: platform: use platform_device_set_of_node()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/of/platform.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index a42224f9d1a888a6e6cad7534cd2c5f110e995da..db45d1e99bf9b027548aac3a15bf754b3c023161 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -126,7 +126,7 @@ struct platform_device *of_device_alloc(struct device_node *np,
 	}
 
 	/* setup generic device info */
-	device_set_node(&dev->dev, of_fwnode_handle(of_node_get(np)));
+	platform_device_set_of_node(dev, np);
 	dev->dev.parent = parent ? : &platform_bus;
 
 	if (bus_id)

-- 
2.47.3

[PATCH 10/23] powerpc/powermac: use platform_device_set_of_node()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 arch/powerpc/platforms/powermac/low_i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/powermac/low_i2c.c b/arch/powerpc/platforms/powermac/low_i2c.c
index 973f58771d9636605ed5d3e91b45008543b584d3..a175a32a222bab4cc7400f6ab6071f5630db2cb8 100644
--- a/arch/powerpc/platforms/powermac/low_i2c.c
+++ b/arch/powerpc/platforms/powermac/low_i2c.c
@@ -1471,7 +1471,7 @@ static int __init pmac_i2c_create_platform_devices(void)
 		if (bus->platform_dev == NULL)
 			return -ENOMEM;
 		bus->platform_dev->dev.platform_data = bus;
-		bus->platform_dev->dev.of_node = of_node_get(bus->busnode);
+		platform_device_set_of_node(bus->platform_dev, bus->busnode);
 		platform_device_add(bus->platform_dev);
 	}
 

-- 
2.47.3

[PATCH 11/23] i2c: pxa-pci: use platform_device_set_of_node()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/i2c/busses/i2c-pxa-pci.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-pxa-pci.c b/drivers/i2c/busses/i2c-pxa-pci.c
index dbd542300f80043c6bc65a69fa27ca7b3d5fe787..92a0647f08c69f841ca99caca757c1728b3f6fce 100644
--- a/drivers/i2c/busses/i2c-pxa-pci.c
+++ b/drivers/i2c/busses/i2c-pxa-pci.c
@@ -76,7 +76,8 @@ static struct platform_device *add_i2c_device(struct pci_dev *dev, int bar)
 		goto out;
 	}
 	pdev->dev.parent = &dev->dev;
-	pdev->dev.of_node = child;
+
+	platform_device_set_of_node(pdev, child);
 
 	ret = platform_device_add_resources(pdev, res, ARRAY_SIZE(res));
 	if (ret)

-- 
2.47.3

Re: [PATCH 11/23] i2c: pxa-pci: use platform_device_set_of_node()

[Wolfram Sang]

On Thu, May 21, 2026 at 10:36:34AM +0200, Bartosz Golaszewski wrote:
> Ahead of reworking the reference counting logic for platform devices,
> encapsulate the assignment of the OF node for dynamically allocated
> platform devices with the provided helper.
> 
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

Acked-by: Wolfram Sang <wsa+renesas@sang-engineering.com> # for I2C

Re: [PATCH 11/23] i2c: pxa-pci: use platform_device_set_of_node()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] OF node reference leak when replacing direct assignment with platform_device_set_of_node().
--

commit 97e00c5939b668c9a126c1fc7447ee82d933bd92
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

i2c: pxa-pci: use platform_device_set_of_node()
    
Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

> diff --git a/drivers/i2c/busses/i2c-pxa-pci.c b/drivers/i2c/busses/i2c-pxa-pci.c
> index dbd542300f800..92a0647f08c69 100644
> --- a/drivers/i2c/busses/i2c-pxa-pci.c
> +++ b/drivers/i2c/busses/i2c-pxa-pci.c

[ ... ]

> @@ -76,7 +76,8 @@ static struct platform_device *add_i2c_device(struct pci_dev *dev, int bar)
>  		goto out;
>  	}
>  	pdev->dev.parent = &dev->dev;
> -	pdev->dev.of_node = child;
> +
> +	platform_device_set_of_node(pdev, child);

[Severity: Medium]
Does this change result in an OF node reference leak?

Earlier in add_i2c_device(), the child node is acquired by breaking out of a
for_each_child_of_node loop, which holds a reference to the node:

	for_each_child_of_node(dev->dev.of_node, child) {
		...
		break;
	}

Previously, assigning pdev->dev.of_node = child implicitly transferred this
reference to the platform device, which would eventually be released during
device cleanup. 

However, platform_device_set_of_node explicitly acquires an additional
reference via of_node_get:

drivers/base/platform.c:platform_device_set_of_node() {
	...
	pdev->dev.of_node = of_node_get(np);
	...
}

Because the helper now manages its own reference, the original reference
held by the local child variable appears to be unconsumed. Should there
be an explicit of_node_put(child) called after platform_device_set_of_node
to prevent a leak?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=11

[PATCH 12/23] iommu/fsl: use platform_device_set_of_node()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/iommu/fsl_pamu.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/iommu/fsl_pamu.c b/drivers/iommu/fsl_pamu.c
index 25aa477a95a95cb4fa4e132727cde0a936750ee2..012839fa0d8a27cafc6a441373f4f6da794388c1 100644
--- a/drivers/iommu/fsl_pamu.c
+++ b/drivers/iommu/fsl_pamu.c
@@ -973,7 +973,8 @@ static __init int fsl_pamu_init(void)
 		ret = -ENOMEM;
 		goto error_device_alloc;
 	}
-	pdev->dev.of_node = of_node_get(np);
+
+	platform_device_set_of_node(pdev, np);
 
 	ret = pamu_domain_init();
 	if (ret)
@@ -985,12 +986,10 @@ static __init int fsl_pamu_init(void)
 		goto error_device_add;
 	}
 
+	of_node_put(np);
 	return 0;
 
 error_device_add:
-	of_node_put(pdev->dev.of_node);
-	pdev->dev.of_node = NULL;
-
 	platform_device_put(pdev);
 
 error_device_alloc:

-- 
2.47.3

Re: [PATCH 12/23] iommu/fsl: use platform_device_set_of_node()

[Robin Murphy]

On 2026-05-21 9:36 am, Bartosz Golaszewski wrote:
> Ahead of reworking the reference counting logic for platform devices,
> encapsulate the assignment of the OF node for dynamically allocated
> platform devices with the provided helper.

FWIW,

Acked-by: Robin Murphy <robin.murphy@arm.com>

Although I'm not sure the whole lot couldn't just be replaced with 
of_platform_device_create(), but then frankly this driver is on life 
support anyway as it only serves one very niche VFIO use-case and it's 
not clear whether it has any real mainline users left.

> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> ---
>   drivers/iommu/fsl_pamu.c | 7 +++----
>   1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/iommu/fsl_pamu.c b/drivers/iommu/fsl_pamu.c
> index 25aa477a95a95cb4fa4e132727cde0a936750ee2..012839fa0d8a27cafc6a441373f4f6da794388c1 100644
> --- a/drivers/iommu/fsl_pamu.c
> +++ b/drivers/iommu/fsl_pamu.c
> @@ -973,7 +973,8 @@ static __init int fsl_pamu_init(void)
>   		ret = -ENOMEM;
>   		goto error_device_alloc;
>   	}
> -	pdev->dev.of_node = of_node_get(np);
> +
> +	platform_device_set_of_node(pdev, np);
>   
>   	ret = pamu_domain_init();
>   	if (ret)
> @@ -985,12 +986,10 @@ static __init int fsl_pamu_init(void)
>   		goto error_device_add;
>   	}
>   
> +	of_node_put(np);
>   	return 0;
>   
>   error_device_add:
> -	of_node_put(pdev->dev.of_node);
> -	pdev->dev.of_node = NULL;
> -
>   	platform_device_put(pdev);
>   
>   error_device_alloc:
> 

[PATCH 13/23] net: bcmgenet: use platform_device_set_of_node()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/net/ethernet/broadcom/genet/bcmmii.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index a4e0d5a682687533a1b034ccf56cdb363d6b7786..451b23a039cebb777f356f64924838230052dc45 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -490,10 +490,14 @@ static int bcmgenet_mii_register(struct bcmgenet_priv *priv)
 	/* Retain this platform_device pointer for later cleanup */
 	priv->mii_pdev = ppdev;
 	ppdev->dev.parent = &pdev->dev;
-	if (dn)
-		ppdev->dev.of_node = bcmgenet_mii_of_find_mdio(priv);
-	else
+
+	if (dn) {
+		struct device_node *np __free(device_node) = bcmgenet_mii_of_find_mdio(priv);
+
+		platform_device_set_of_node(ppdev, np);
+	} else {
 		ppd.phy_mask = ~0;
+	}
 
 	ret = platform_device_add_resources(ppdev, &res, 1);
 	if (ret)

-- 
2.47.3

Re: [PATCH 13/23] net: bcmgenet: use platform_device_set_of_node()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Mixing `goto`-based error handling and scope-based cleanup (`__free`) in the same function.
--

commit f58d150fd8f8c2ac44d34e557009b66b7a1a1343
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

net: bcmgenet: use platform_device_set_of_node()

This commit uses the platform_device_set_of_node() helper to assign the OF
node for dynamically allocated platform devices. This is done ahead of
reworking the reference counting logic for platform devices.

> diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
> index a4e0d5a682687..451b23a039ceb 100644
> --- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
> +++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
> @@ -490,10 +490,14 @@ static int bcmgenet_mii_register(struct bcmgenet_priv *priv)
>  	/* Retain this platform_device pointer for later cleanup */
>  	priv->mii_pdev = ppdev;
>  	ppdev->dev.parent = &pdev->dev;
> -	if (dn)
> -		ppdev->dev.of_node = bcmgenet_mii_of_find_mdio(priv);
> -	else
> +
> +	if (dn) {
> +		struct device_node *np __free(device_node) = bcmgenet_mii_of_find_mdio(priv);

[Severity: Low]
Does this mix scope-based cleanup and goto-based error handling in the same
function?

The bcmgenet_mii_register() function currently uses a goto-based cleanup path
later in the function. According to include/linux/cleanup.h, the expectation
is that usage of goto and cleanup helpers should never be mixed in the same
function.

Could the entire function be converted to use scope-based cleanups, or should
this remain as a traditional cleanup to avoid mixing the two patterns?

> +
> +		platform_device_set_of_node(ppdev, np);
> +	} else {
>  		ppd.phy_mask = ~0;
> +	}
>  
>  	ret = platform_device_add_resources(ppdev, &res, 1);
>  	if (ret)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=13

[PATCH 14/23] pmdomain: imx: use platform_device_set_of_node()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/pmdomain/imx/gpc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/pmdomain/imx/gpc.c b/drivers/pmdomain/imx/gpc.c
index 42e50c9b4fb9ffb96a20a462d4eb5168942a893c..abca5f449a226fbae4213926e1395c413160c950 100644
--- a/drivers/pmdomain/imx/gpc.c
+++ b/drivers/pmdomain/imx/gpc.c
@@ -487,8 +487,7 @@ static int imx_gpc_probe(struct platform_device *pdev)
 			domain->ipg_rate_mhz = ipg_rate_mhz;
 
 			pd_pdev->dev.parent = &pdev->dev;
-			pd_pdev->dev.of_node = of_node_get(np);
-			pd_pdev->dev.fwnode = of_fwnode_handle(np);
+			platform_device_set_of_node(pd_pdev, np);
 
 			ret = platform_device_add(pd_pdev);
 			if (ret) {

-- 
2.47.3

Re: [PATCH 14/23] pmdomain: imx: use platform_device_set_of_node()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] OF node reference underflow leading to double-free and use-after-free in gpcv2 driver.
--

commit bd67fa18bf0839e7723c9cc2462ace1f391ce4b1
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

pmdomain: imx: use platform_device_set_of_node()

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

> diff --git a/drivers/pmdomain/imx/gpc.c b/drivers/pmdomain/imx/gpc.c
> index 42e50c9b4fb9f..abca5f449a226 100644
> --- a/drivers/pmdomain/imx/gpc.c
> +++ b/drivers/pmdomain/imx/gpc.c
> @@ -487,8 +487,7 @@ static int imx_gpc_probe(struct platform_device *pdev)
>  			domain->ipg_rate_mhz = ipg_rate_mhz;
>  
>  			pd_pdev->dev.parent = &pdev->dev;
> -			pd_pdev->dev.of_node = of_node_get(np);
> -			pd_pdev->dev.fwnode = of_fwnode_handle(np);
> +			platform_device_set_of_node(pd_pdev, np);

[Severity: High]
This isn't a bug introduced by this patch, but does the same fix need to be
applied to drivers/pmdomain/imx/gpcv2.c?

In imx_gpcv2_probe(), the scoped iterator for_each_child_of_node_scoped()
drops the reference on np when the loop iteration ends. However, the child
platform device's node is assigned using device_set_node(), which does not
increment the OF node's reference count:

drivers/pmdomain/imx/gpcv2.c:imx_gpcv2_probe()
    ...
    for_each_child_of_node_scoped(pgc_np, np) {
        ...
        pd_pdev->dev.parent = dev;
        device_set_node(&pd_pdev->dev, of_fwnode_handle(np));
        
        ret = platform_device_add(pd_pdev);
        if (ret) {
            platform_device_put(pd_pdev);
            ...
    }

When the platform device is eventually unregistered, or freed on the error
path via platform_device_put(), platform_device_release() will invoke
of_node_put() (or fwnode_handle_put() after the refcounting rework). This
results in a double-free of the OF node, since the initial reference was
never taken.

Should platform_device_set_of_node() also be used in gpcv2.c to properly
handle these reference counts?

>  
>  			ret = platform_device_add(pd_pdev);
>  			if (ret) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=14

[PATCH 15/23] mfd: tps6586: use platform_device_set_of_node()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/mfd/tps6586x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
index f5f805446603315ba76ce1fc501c908f1cec0d16..3cfd2f02b62f3cc370e0d970ec2643b638fd0fec 100644
--- a/drivers/mfd/tps6586x.c
+++ b/drivers/mfd/tps6586x.c
@@ -397,7 +397,7 @@ static int tps6586x_add_subdevs(struct tps6586x *tps6586x,
 
 		pdev->dev.parent = tps6586x->dev;
 		pdev->dev.platform_data = subdev->platform_data;
-		pdev->dev.of_node = of_node_get(subdev->of_node);
+		platform_device_set_of_node(pdev, subdev->of_node);
 
 		ret = platform_device_add(pdev);
 		if (ret) {

-- 
2.47.3

Re: [PATCH 15/23] mfd: tps6586: use platform_device_set_of_node()

[Lee Jones]

On Thu, 21 May 2026, Bartosz Golaszewski wrote:

> Ahead of reworking the reference counting logic for platform devices,
> encapsulate the assignment of the OF node for dynamically allocated
> platform devices with the provided helper.
> 
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

Acked-by: Lee Jones <lee@kernel.org>

> ---
>  drivers/mfd/tps6586x.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
> index f5f805446603315ba76ce1fc501c908f1cec0d16..3cfd2f02b62f3cc370e0d970ec2643b638fd0fec 100644
> --- a/drivers/mfd/tps6586x.c
> +++ b/drivers/mfd/tps6586x.c
> @@ -397,7 +397,7 @@ static int tps6586x_add_subdevs(struct tps6586x *tps6586x,
>  
>  		pdev->dev.parent = tps6586x->dev;
>  		pdev->dev.platform_data = subdev->platform_data;
> -		pdev->dev.of_node = of_node_get(subdev->of_node);
> +		platform_device_set_of_node(pdev, subdev->of_node);
>  
>  		ret = platform_device_add(pdev);
>  		if (ret) {
> 
> -- 
> 2.47.3
> 

-- 
Lee Jones

Re: [PATCH 15/23] mfd: tps6586: use platform_device_set_of_node()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing cleanup of platform sub-devices on the probe error path leads to a resource leak and potential Use-After-Free.
- [High] Missing irq_domain_remove() and irq_free_descs() on error paths and module removal.
--

commit 77ea296910871ac50ea42e73a55af867803293eb
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

mfd: tps6586: use platform_device_set_of_node()

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

> diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
> index f5f8054466033..3cfd2f02b62f3 100644
> --- a/drivers/mfd/tps6586x.c
> +++ b/drivers/mfd/tps6586x.c
> @@ -397,7 +397,7 @@ static int tps6586x_add_subdevs(struct tps6586x *tps6586x,
>  
>  		pdev->dev.parent = tps6586x->dev;
>  		pdev->dev.platform_data = subdev->platform_data;
> -		pdev->dev.of_node = of_node_get(subdev->of_node);
> +		platform_device_set_of_node(pdev, subdev->of_node);
>  
>  		ret = platform_device_add(pdev);
>  		if (ret) {
>  			platform_device_put(pdev);
>  			goto failed;
>  		}

[Severity: High]
This isn't a bug introduced by this patch, but does the probe error path
leak the platform sub-devices?

In tps6586x_i2c_probe(), sub-devices are registered via
tps6586x_add_subdevs(). If a subsequent operation like
devm_register_power_off_handler() fails, the code jumps to err_add_devs and
cleans up MFD devices via mfd_remove_devices():

drivers/mfd/tps6586x.c:tps6586x_i2c_probe() {
    ...
err_add_devs:
	mfd_remove_devices(tps6586x->dev);
err_mfd_add:
	if (client->irq)
		free_irq(client->irq, tps6586x);
	return ret;
}

However, it fails to call tps6586x_remove_subdevs(). The registered
platform sub-devices remain attached, while the parent driver's private
data (tps6586x) is freed.

If any of the leaked sub-devices are subsequently probed or accessed, would
they attempt to access the freed parent driver data, triggering a
use-after-free?

[Severity: High]
This is a pre-existing issue, but does tps6586x_irq_init() leak the IRQ
domain on error paths and module removal?

In tps6586x_irq_init(), an IRQ domain is created using
irq_domain_create_simple(), with the driver's private data (tps6586x) set
as host_data:

drivers/mfd/tps6586x.c:tps6586x_irq_init() {
    ...
	tps6586x->irq_domain = irq_domain_create_simple(dev_fwnode(tps6586x->dev), irq_num,
							new_irq_base, &tps6586x_domain_ops,
							tps6586x);
    ...
}

However, there are no corresponding calls to irq_domain_remove() or
irq_free_descs() on the probe error paths or in tps6586x_i2c_remove().

On unbind or probe failure, the IRQ domain is leaked while the devm_kzalloc
allocated tps6586x structure is freed. If the device is rebound or its
interrupts are looked up, the system may match the leaked IRQ domain on the
device's fwnode.

Would subsequent IRQ mappings invoke tps6586x_irq_map(), dereferencing the
dangling host_data pointer and causing a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=15

[PATCH 16/23] slimbus: qcom-ngd-ctrl: use platform_device_set_of_node()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/slimbus/qcom-ngd-ctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 428266949fdd07ac13c5553bded891225c6e1a16..70f06981533237cb5de47a855462220050f6d82b 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1542,7 +1542,7 @@ static int of_qcom_slim_ngd_register(struct device *parent,
 			kfree(ngd);
 			return ret;
 		}
-		ngd->pdev->dev.of_node = of_node_get(node);
+		platform_device_set_of_node(ngd->pdev, node);
 		ctrl->ngd = ngd;
 
 		ret = platform_device_add(ngd->pdev);

-- 
2.47.3

Re: [PATCH 16/23] slimbus: qcom-ngd-ctrl: use platform_device_set_of_node()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 10 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Probe error path bypasses cleanup labels, leaking resources and leaving dangling notifiers.
- [Critical] Early IRQ request allows a race condition leading to a NULL pointer dereference or access to uninitialized locks in the interrupt handler.
- [Critical] PDR/SSR notifiers are registered before their corresponding work structs are initialized, leading to potential panics on early events.
- [High] Unchecked return value from of_match_node() causes NULL pointer dereference.
- [High] Child device remove callback frees parent device resources, leading to Use-After-Free and resource leaks.
- [High] Registering a platform driver from within a platform device probe callback.
- [High] Error handling labels are in reversed order, causing invalid pointer accesses and incomplete cleanup.
- [High] Dangling `ctrl->ngd` pointer is left behind on `platform_device_add()` failure.
- [High] The driver fails to cancel `ctrl->ngd_up_work` during removal, leading to a Use-After-Free if the work is pending.
- [Medium] Invalid pointer arithmetic causing out-of-bounds MMIO mapping if child reg property is 0.
--

commit 764709448d03c52a2585b5617fd60c1746e5cc5a
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

slimbus: qcom-ngd-ctrl: use platform_device_set_of_node()

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

> diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
> index 428266949fdd0..70f0698153323 100644
> --- a/drivers/slimbus/qcom-ngd-ctrl.c
> +++ b/drivers/slimbus/qcom-ngd-ctrl.c
> @@ -1542,7 +1542,7 @@ static int of_qcom_slim_ngd_register(struct device *parent,
>  			kfree(ngd);
>  			return ret;
>  		}
> -		ngd->pdev->dev.of_node = of_node_get(node);
> +		platform_device_set_of_node(ngd->pdev, node);
>  		ctrl->ngd = ngd;
>  
>  		ret = platform_device_add(ngd->pdev);

[Severity: High]
This is a pre-existing issue, but is a dangling ctrl->ngd pointer left behind
on platform_device_add() failure?

During of_qcom_slim_ngd_register(), ctrl->ngd is assigned before
platform_device_add() is called. If adding the device fails, kfree(ngd) is
called, but ctrl->ngd is never reset to null.

Since the irq and ssr notifier are already active, if either fires before the
ctrl structure is eventually destroyed, they will dereference the freed ngd
pointer, resulting in a use-after-free.

[Severity: High]
This is a pre-existing issue, but does this lack a null check?

In of_qcom_slim_ngd_register(), of_match_node() is called with
parent->of_node, and its return value is immediately dereferenced via
match->data. If the device is instantiated without a device tree (e.g., via
sysfs manual bind) or if the match fails, of_match_node() returns null.
Dereferencing it without a null check causes a kernel panic.

[Severity: Critical]
This is a pre-existing issue, but does the probe error path bypass cleanup
labels?

In qcom_slim_ngd_ctrl_probe(), if of_qcom_slim_ngd_register() fails (e.g.
returning -ENODEV when no child nodes exist), the function directly executes
return of_qcom_slim_ngd_register(...).

This bypasses the error cleanup labels err_pdr_alloc and err_pdr_lookup,
failing to unregister the ssr notifier and free the pdr handle. Since the ctrl
structure is devres-managed, it is freed upon probe failure. A subsequent ssr
notification will then dereference the freed ctrl object, leading to a
use-after-free.

[Severity: High]
This is a pre-existing issue, but does the child device remove callback free
parent device resources?

The parent device's probe (qcom_slim_ngd_ctrl_probe) allocates ctrl->pdr and
registers ctrl->notifier. However, the child device's remove callback
(qcom_slim_ngd_remove) frees them.

If a user unbinds the child device via sysfs, these resources are freed while
the parent is still active. If the child is bound again, or if an ssr event
triggers, it will access the freed resources. Furthermore, if no child is ever
added or probed, these resources are never freed when the parent is removed.

[Severity: High]
This is a pre-existing issue, but is it correct to register a platform driver
from within a platform device probe callback?

qcom_slim_ngd_ctrl_probe() calls platform_driver_register() during its own
probe. This violates the Linux device driver model. If there are multiple
instances of the qcom,slim-ngd-ctrl controller, the second probe will fail
to register the driver but ignore the error.

Additionally, the parent's remove callback unregisters the driver globally,
forcefully unbinding all ngd child devices across all controller instances.

[Severity: Medium]
This is a pre-existing issue, but can invalid pointer arithmetic cause an
out-of-bounds mmio mapping if the child reg property is 0?

If a child node specifies reg = <0>, ngd->id becomes 0. The expression
(ngd->id - 1) * data->size multiplies -1 by a u32. Due to type promotion,
this wraps to a huge unsigned value (0xffffffff * data->size), resulting in
an out-of-bounds mmio address calculation when added to the ctrl->base
pointer.

[Severity: High]
This is a pre-existing issue, but are the error handling labels in reversed
order?

In qcom_slim_ngd_ctrl_probe(), the cleanup labels are in the wrong order. If
pdr_add_lookup() fails, the code jumps to err_pdr_lookup, completely skipping
qcom_unregister_ssr_notifier(), leaking the notifier and opening a
use-after-free window.

If pdr_handle_alloc() fails, it jumps to err_pdr_alloc, unregisters the
notifier, and falls through to err_pdr_lookup, calling pdr_handle_release()
on an IS_ERR pointer.

[Severity: Critical]
This is a pre-existing issue, but does the early irq request allow a race
condition?

In qcom_slim_ngd_ctrl_probe(), devm_request_irq() is called before
of_qcom_slim_ngd_register() initializes the ctrl->ngd pointer, and before
ctrl->ctrl.dev and locks are initialized.

If an early or pending hardware interrupt fires during this window,
qcom_slim_ngd_interrupt() will execute and immediately dereference
ctrl->ngd->base (which is null) or call pm_runtime_suspended(ctrl->ctrl.dev)
(also null), leading to a null pointer dereference.

[Severity: Critical]
This is a pre-existing issue, but are pdr and ssr notifiers registered before
their corresponding work structs are initialized?

The ssr notifier and pdr handle are registered in the parent controller probe,
immediately exposing the driver to notifications. The handler
qcom_slim_ngd_ssr_pdr_notify() calls schedule_work(&ctrl->ngd_up_work).

However, ctrl->ngd_up_work is initialized much later in qcom_slim_ngd_probe()
(the child driver's probe). If an event arrives before the child driver
probes, the kernel will enqueue an uninitialized work_struct, causing
workqueue list corruption and a kernel panic.

[Severity: High]
This is a pre-existing issue, but does the driver fail to cancel
ctrl->ngd_up_work during removal?

The driver schedules ctrl->ngd_up_work on the global system workqueue via
schedule_work(). However, neither qcom_slim_ngd_remove() nor
qcom_slim_ngd_ctrl_remove() calls cancel_work_sync(&ctrl->ngd_up_work) before
returning.

The memory for ctrl will then be freed by devres. If the scheduled work
executes after the memory is freed, it results in a use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=16

[PATCH 17/23] net: mv643xx: use platform_device_set_of_node()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 1881583be5ce2e972fceb14c2b8348280c49ad1d..9caa1e47c174c9d7a161b7f2e2ee12a829b813d4 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -2780,7 +2780,7 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev,
 		goto put_err;
 	}
 	ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
-	ppdev->dev.of_node = of_node_get(pnp);
+	platform_device_set_of_node(ppdev, pnp);
 
 	ret = platform_device_add_resources(ppdev, &res, 1);
 	if (ret)

-- 
2.47.3

Re: [PATCH 17/23] net: mv643xx: use platform_device_set_of_node()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Directly assigning a `devm_kzalloc()` pointer to `pdev->dev.platform_data` leads to an invalid `kfree()` upon platform device release.
--

commit 8b40f4373a03093beb86a0174e83ff04d8438e9e
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

net: mv643xx: use platform_device_set_of_node()

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node for dynamically allocated
platform devices with the provided helper.

> diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
> --- a/drivers/net/ethernet/marvell/mv643xx_eth.c
> +++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
> @@ -2780,7 +2780,7 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev,
>  		goto put_err;
>  	}
>  	ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
> -	ppdev->dev.of_node = of_node_get(pnp);
> +	platform_device_set_of_node(ppdev, pnp);

[Severity: High]
This is a pre-existing issue, but does the driver incorrectly assign a
devm_kzalloc() pointer to pdev->dev.platform_data elsewhere in this file?

In mv643xx_eth_shared_of_probe(), memory is allocated via devm_kzalloc() and
directly assigned to pdev->dev.platform_data. Because the parent pdev is
instantiated from the Device Tree, its standard lifecycle release function is
platform_device_release(), which unconditionally calls:

    kfree(pdev->dev.platform_data);

Calling kfree() on memory allocated by devm_kzalloc() is invalid since the
devres mechanism adds a hidden header, causing the pointer passed to kfree()
to be offset from the actual slab object, which can lead to a panic.

Furthermore, on driver unbind, devres frees the memory, leaving a dangling
pointer in pdev->dev.platform_data that could trigger a use-after-free or
double-free when the device is eventually released.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=17

[PATCH 18/23] drm/xe/i2c: use platform_device_set_fwnode()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the firmware node for dynamically allocated
platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/gpu/drm/xe/xe_i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_i2c.c b/drivers/gpu/drm/xe/xe_i2c.c
index 706783863d07d66b4685005d6649b3cd143ecc3b..af4ebd93ad8e68c95a14cdf99de0959fbe080354 100644
--- a/drivers/gpu/drm/xe/xe_i2c.c
+++ b/drivers/gpu/drm/xe/xe_i2c.c
@@ -123,7 +123,7 @@ static int xe_i2c_register_adapter(struct xe_i2c *i2c)
 	}
 
 	pdev->dev.parent = i2c->drm_dev;
-	pdev->dev.fwnode = fwnode;
+	platform_device_set_fwnode(pdev, fwnode);
 	i2c->adapter_node = fwnode;
 	i2c->pdev = pdev;
 

-- 
2.47.3

Re: [PATCH 18/23] drm/xe/i2c: use platform_device_set_fwnode()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `cancel_work_sync(&i2c->work)` in teardown path leads to Use-After-Free.
- [High] Missing reference count on I2C adapter across asynchronous handoff leads to Use-After-Free.
- [High] Unhandled I2C adapter removal leaves dangling client pointers which are double-freed during module unload.
--

commit a13cd1dfe26fa249e61eac41fbff512943d0184b
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

drm/xe/i2c: use platform_device_set_fwnode()

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the firmware node for dynamically allocated
platform devices with the provided helper.

> diff --git a/drivers/gpu/drm/xe/xe_i2c.c b/drivers/gpu/drm/xe/xe_i2c.c
> index 706783863d07d..af4ebd93ad8e6 100644
> --- a/drivers/gpu/drm/xe/xe_i2c.c
> +++ b/drivers/gpu/drm/xe/xe_i2c.c
> @@ -123,7 +123,7 @@ static int xe_i2c_register_adapter(struct xe_i2c *i2c)
>  	}
>  
>  	pdev->dev.parent = i2c->drm_dev;
> -	pdev->dev.fwnode = fwnode;
> +	platform_device_set_fwnode(pdev, fwnode);
>  	i2c->adapter_node = fwnode;
>  	i2c->pdev = pdev;

[Severity: High]
This isn't a bug introduced by this patch, but does the teardown path miss a
cancel_work_sync(&i2c->work)?

The xe_i2c_probe() function initializes i2c->work, which is scheduled
asynchronously in xe_i2c_notifier() when the I2C adapter is added. However,
the driver's teardown function xe_i2c_remove() fails to call
cancel_work_sync(&i2c->work) before returning.

Because i2c is allocated via devm_kzalloc(), the memory is automatically
freed by the devres framework shortly after xe_i2c_remove() completes. If the
background work is still pending or actively executing during or after this
teardown, xe_i2c_client_work() will dereference the freed i2c object to
access i2c->adapter and i2c->ep.addr[1], which could cause a use-after-free.

[Severity: High]
This is a pre-existing issue, but does the I2C adapter need its reference
count incremented across the asynchronous handoff?

In xe_i2c_notifier(), when a new I2C adapter is added, i2c->adapter is
assigned the raw adapter pointer and i2c->work is scheduled. No reference is
taken to ensure the adapter stays alive (e.g., via i2c_get_adapter()).

The scheduled background task xe_i2c_client_work() later accesses this
pointer to instantiate a client device via i2c_new_client_device(). If the
underlying I2C adapter is unbound or removed (e.g., via a sysfs unbind of
the i2c_designware driver) between the notifier firing and the work executing,
the adapter memory will be freed. The workqueue will then dereference a
dangling pointer when trying to register the client.

[Severity: High]
This isn't a bug introduced by this patch, but can unhandled I2C adapter
removal leave dangling client pointers?

When an I2C adapter is removed (e.g., by unbinding the platform device), the
I2C core (i2c_del_adapter()) automatically unregisters and frees all
associated client devices.

The xe_i2c_notifier() does not handle BUS_NOTIFY_DEL_DEVICE to track adapter
removal, so it fails to clear the i2c->client[i] array, leaving it populated
with dangling pointers. Later, when the xe driver is unloaded and
xe_i2c_remove() runs, it unconditionally calls
i2c_unregister_device(i2c->client[i]) on the already freed client pointers,
which could lead to a double free or use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=18

[PATCH 19/23] platform/surface: gpe: use platform_device_set_fwnode()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the firmware node for dynamically allocated
platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/platform/surface/surface_gpe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/surface/surface_gpe.c b/drivers/platform/surface/surface_gpe.c
index b359413903b13c4f8e8b284ef7ae6f6db3f47d72..40896a8544b0a4da4261ea881b1eaed62d93b32b 100644
--- a/drivers/platform/surface/surface_gpe.c
+++ b/drivers/platform/surface/surface_gpe.c
@@ -317,7 +317,7 @@ static int __init surface_gpe_init(void)
 		goto err_alloc;
 	}
 
-	pdev->dev.fwnode = fwnode;
+	platform_device_set_fwnode(pdev, fwnode);
 
 	status = platform_device_add(pdev);
 	if (status)

-- 
2.47.3

Re: [PATCH 19/23] platform/surface: gpe: use platform_device_set_fwnode()

[Ilpo Järvinen]

[-- Attachment #1: Type: text/plain, Size: 1050 bytes --]

On Thu, 21 May 2026, Bartosz Golaszewski wrote:

> Ahead of reworking the reference counting logic for platform devices,
> encapsulate the assignment of the firmware node for dynamically allocated
> platform devices with the provided helper.
> 
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> ---
>  drivers/platform/surface/surface_gpe.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/surface/surface_gpe.c b/drivers/platform/surface/surface_gpe.c
> index b359413903b13c4f8e8b284ef7ae6f6db3f47d72..40896a8544b0a4da4261ea881b1eaed62d93b32b 100644
> --- a/drivers/platform/surface/surface_gpe.c
> +++ b/drivers/platform/surface/surface_gpe.c
> @@ -317,7 +317,7 @@ static int __init surface_gpe_init(void)
>  		goto err_alloc;
>  	}
>  
> -	pdev->dev.fwnode = fwnode;
> +	platform_device_set_fwnode(pdev, fwnode);
>  
>  	status = platform_device_add(pdev);
>  	if (status)
> 
> 

Acked-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

-- 
 i.

[PATCH 20/23] usb: chipidea: use platform_device_set_of_node_from_dev()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node from another device for
dynamically allocated platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/usb/chipidea/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 7cfabb04a4fb80c6db56ccb430d290dbac61b716..5dd415f42fe0dd026e8a1cc162357e42ba8ceaec 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -888,7 +888,7 @@ struct platform_device *ci_hdrc_add_device(struct device *dev,
 	}
 
 	pdev->dev.parent = dev;
-	device_set_of_node_from_dev(&pdev->dev, dev);
+	platform_device_set_of_node_from_dev(pdev, dev);
 
 	ret = platform_device_add_resources(pdev, res, nres);
 	if (ret)

-- 
2.47.3

[PATCH 21/23] usb: musb: use platform_device_set_of_node_from_dev()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node from another device for
dynamically allocated platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/usb/musb/jz4740.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c
index df56c972986f7c4f5174a227f35c7e1ac9afa7ca..c770ba576f05b6b672836753cd9b696b752d017a 100644
--- a/drivers/usb/musb/jz4740.c
+++ b/drivers/usb/musb/jz4740.c
@@ -273,7 +273,7 @@ static int jz4740_probe(struct platform_device *pdev)
 	musb->dev.parent		= dev;
 	musb->dev.dma_mask		= &musb->dev.coherent_dma_mask;
 	musb->dev.coherent_dma_mask	= DMA_BIT_MASK(32);
-	device_set_of_node_from_dev(&musb->dev, dev);
+	platform_device_set_of_node_from_dev(musb, dev);
 
 	glue->pdev			= musb;
 	glue->clk			= clk;

-- 
2.47.3

[PATCH 22/23] reset: rzg2l: use platform_device_set_of_node_from_dev()

[Bartosz Golaszewski]

Ahead of reworking the reference counting logic for platform devices,
encapsulate the assignment of the OF node from another device for
dynamically allocated platform devices with the provided helper.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/reset/reset-rzg2l-usbphy-ctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/reset/reset-rzg2l-usbphy-ctrl.c b/drivers/reset/reset-rzg2l-usbphy-ctrl.c
index fd75d9601a3bfde7b7e3f6db287ec8c5c45a20ab..f003b360629c90bb37ed0ade7a675b5b0f28fa7e 100644
--- a/drivers/reset/reset-rzg2l-usbphy-ctrl.c
+++ b/drivers/reset/reset-rzg2l-usbphy-ctrl.c
@@ -249,7 +249,7 @@ static int rzg2l_usbphy_ctrl_probe(struct platform_device *pdev)
 	vdev->dev.parent = dev;
 	priv->vdev = vdev;
 
-	device_set_of_node_from_dev(&vdev->dev, dev);
+	platform_device_set_of_node_from_dev(vdev, dev);
 	error = platform_device_add(vdev);
 	if (error)
 		goto err_device_put;

-- 
2.47.3

[PATCH 23/23] driver core: platform: count references to all kinds of firmware nodes

[Bartosz Golaszewski]

When using platform_device_register_full(), we currently only increase
the reference count of the OF node associated with a platform device. We
symmetrically decrease it in platform_device_release(). With all users in
tree now converted to using provided platform device helpers for
assigning OF and firmware nodes, we can now switch to counting references
of all kinds of firmware nodes.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/base/platform.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index b14f707f077bcc535fff9484d1ec904616d0a1d1..2a99162263e95f026830a437047dbf9fd347a27e 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -599,7 +599,7 @@ static void platform_device_release(struct device *dev)
 	struct platform_object *pa = container_of(dev, struct platform_object,
 						  pdev.dev);
 
-	of_node_put(pa->pdev.dev.of_node);
+	fwnode_handle_put(pa->pdev.dev.fwnode);
 	kfree(pa->pdev.dev.platform_data);
 	kfree(pa->pdev.mfd_cell);
 	kfree(pa->pdev.resource);
@@ -705,9 +705,7 @@ EXPORT_SYMBOL_GPL(platform_device_add_data);
 void platform_device_set_of_node(struct platform_device *pdev,
 				 struct device_node *np)
 {
-	of_node_put(pdev->dev.of_node);
-	pdev->dev.of_node = of_node_get(np);
-	pdev->dev.fwnode = of_fwnode_handle(np);
+	platform_device_set_fwnode(pdev, of_fwnode_handle(np));
 }
 EXPORT_SYMBOL_GPL(platform_device_set_of_node);
 
@@ -723,10 +721,9 @@ EXPORT_SYMBOL_GPL(platform_device_set_of_node);
 void platform_device_set_fwnode(struct platform_device *pdev,
 				struct fwnode_handle *fwnode)
 {
-	if (is_of_node(fwnode))
-		platform_device_set_of_node(pdev, to_of_node(fwnode));
-	else
-		pdev->dev.fwnode = fwnode;
+	fwnode_handle_put(pdev->dev.fwnode);
+	pdev->dev.fwnode = fwnode_handle_get(fwnode);
+	pdev->dev.of_node = to_of_node(fwnode);
 }
 EXPORT_SYMBOL_GPL(platform_device_set_fwnode);
 
@@ -921,8 +918,8 @@ struct platform_device *platform_device_register_full(const struct platform_devi
 		return ERR_PTR(-ENOMEM);
 
 	pdev->dev.parent = pdevinfo->parent;
-	pdev->dev.fwnode = pdevinfo->fwnode;
-	pdev->dev.of_node = of_node_get(to_of_node(pdev->dev.fwnode));
+	pdev->dev.fwnode = fwnode_handle_get(pdevinfo->fwnode);
+	pdev->dev.of_node = to_of_node(pdev->dev.fwnode);
 	dev_assign_of_node_reused(&pdev->dev, pdevinfo->of_node_reused);
 
 	if (pdevinfo->dma_mask) {

-- 
2.47.3

Re: [PATCH 23/23] driver core: platform: count references to all kinds of firmware nodes

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Unconditionally putting `dev->fwnode` in `platform_device_release()` causes refcount underflows and use-after-free bugs for dynamically allocated fwnodes manually assigned by drivers.
- [Medium] The firmware node reference acquired during `platform_device_register_full()` is leaked on the error path because `ACPI_COMPANION_SET()` clears the `fwnode` pointer before it can be released.
--

commit e4918f4a259d02413dc609fd6279d8c955cad207
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

driver core: platform: count references to all kinds of firmware nodes

This commit switches the platform device core to manage references for
all firmware nodes uniformly, rather than just OF nodes. It updates
platform_device_release() and assignment functions to use fwnode APIs.

> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
> --- a/drivers/base/platform.c
> +++ b/drivers/base/platform.c
> @@ -599,7 +599,7 @@ static void platform_device_release(struct device *dev)
>  	struct platform_object *pa = container_of(dev, struct platform_object,
>  						  pdev.dev);
>  
> -	of_node_put(pa->pdev.dev.of_node);
> +	fwnode_handle_put(pa->pdev.dev.fwnode);

[Severity: High]
If drivers manually assign their parent's fwnode during probe without
incrementing the reference count, will this regression cause a reference
count underflow?

For instance, some drivers assign the fwnode directly:

device_set_node(&pdev->dev, dev_fwnode(pdev->dev.parent));

Previously, of_node_put() was a safe no-op for non-OF nodes like software
nodes. Now, platform_device_release() unconditionally calls
fwnode_handle_put().

If the parent's fwnode is a dynamically allocated software node,
software_node_put() will be invoked without a corresponding
software_node_get().

Could this prematurely free the node and lead to a use-after-free for the
parent and other devices sharing it?

[ ... ]

> @@ -921,8 +918,8 @@ struct platform_device *platform_device_register_full(const struct platform_devi
>  		return ERR_PTR(-ENOMEM);
>  
>  	pdev->dev.parent = pdevinfo->parent;
> -	pdev->dev.fwnode = pdevinfo->fwnode;
> -	pdev->dev.of_node = of_node_get(to_of_node(pdev->dev.fwnode));
> +	pdev->dev.fwnode = fwnode_handle_get(pdevinfo->fwnode);
> +	pdev->dev.of_node = to_of_node(pdev->dev.fwnode);
>  	dev_assign_of_node_reused(&pdev->dev, pdevinfo->of_node_reused);
>  
>  	if (pdevinfo->dma_mask) {

[Severity: Medium]
Does this code leak the firmware node reference if an error occurs later in
this function?

If platform_device_add() fails, the error path executes:

err:
        ACPI_COMPANION_SET(&pdev->dev, NULL);
        platform_device_put(pdev);

The ACPI_COMPANION_SET() macro expands to set_primary_fwnode() and clears
pdev->dev.fwnode.

When platform_device_put() eventually calls platform_device_release(), the
fwnode pointer is already NULL.

Since fwnode_handle_put() acts as a no-op on a NULL pointer, will the
reference acquired here by fwnode_handle_get() be left unbalanced?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521-pdev-fwnode-ref-v1-0-88c324a1b8d2@oss.qualcomm.com?part=23

Re: (subset) [PATCH 00/23] driver core: count references of the platform device's fwnode, not OF node

[Srinivas Kandagatla]

On Thu, 21 May 2026 10:36:23 +0200, Bartosz Golaszewski wrote:
> I'd like to first apologize for the long, treewide series and an
> extensive Cc list but I think it's important to show the big picture and
> the end result of this rework.
> 
> Platform device core provides helper interfaces for dealing with
> dynamically created platform devices. Most users should use
> platform_device_register_full() which encapsulates most of the
> operations but some modules will want to use the split approach of
> calling platform_device_alloc() + platform_device_add() separately for
> various reasons.
> 
> [...]

Applied, thanks!

[03/23] slimbus: qcom-ngd-ctrl: fix OF node refcount
        commit: 0208edaf0b32cae5b922729c4ef52dcd865e2e19

Best regards,
-- 
Srinivas Kandagatla <srini@kernel.org>