Re: [PATCH RFC 2/2] pinctrl: meson: amlogic-a4: support gpiod_to_irq

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Premature `of_node_put()` in `aml_get_of_irq()` creates a dangling pointer, leading to a Use-After-Free.
--

commit 682e8ff8b51a310ddf41177d04828ab2fd8a5670
Author: Xianwei Zhao <xianwei.zhao@amlogic.com>

pinctrl: meson: amlogic-a4: support gpiod_to_irq

This patch adds the to_irq() callback implementation so that gpiod_to_irq()
can map GPIO lines to IRQs correctly.

> diff --git a/drivers/pinctrl/meson/pinctrl-amlogic-a4.c b/drivers/pinctrl/meson/pinctrl-amlogic-a4.c
> index 5ae0c19d007d7..663681887f35c 100644
> --- a/drivers/pinctrl/meson/pinctrl-amlogic-a4.c
> +++ b/drivers/pinctrl/meson/pinctrl-amlogic-a4.c

[ ... ]

> @@ -836,6 +839,32 @@ static int aml_pctl_parse_functions(struct device_node *np,
>  	return 0;
>  }
>  
> +static struct device_node *aml_get_of_irq(struct device_node *np)
> +{
> +	struct device_node *of_irq;
> +
> +	of_irq = of_irq_find_parent(np);
> +	if (of_irq && of_device_is_compatible(of_irq, "amlogic,meson-gpio-intc")) {
> +		of_node_put(of_irq);
> +		return of_irq;

[Severity: High]
Does this premature of_node_put() call create a use-after-free risk?

of_irq_find_parent() returns a device node with an incremented reference
count. By calling of_node_put() before returning the pointer, the reference
is dropped while the pointer is still passed back and cached in bank->of_irq.

Later, aml_gpio_to_irq() dereferences this pointer:

    fwspec.fwnode = of_fwnode_handle(bank->of_irq);

If the device node is dynamically freed (for example, during Device Tree
overlay removal) between caching and use, this would lead to a
use-after-free. Should we retain the reference here until driver teardown
instead?

> +	}
> +
> +	if (of_irq)
> +		of_node_put(of_irq);
> +
> +	return NULL;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611-gpio-to-irq-v1-0-12201716f23f@amlogic.com?part=2