Re: [PATCH v2 19/19] driver core: platform: count references to all kinds of firmware nodes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Memory leak of `of_node` references in platform device release
- [High] Refcount underflow and use-after-free of software nodes on platform device release
--

commit f2aa250a52f31d368fee3251e58597913170101a
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

driver core: platform: count references to all kinds of firmware nodes
    
This patch switches to counting references for all kinds of firmware nodes by
replacing the of_node_put with fwnode_handle_put in platform device release.
It also updates platform device setup helpers to properly acquire fwnode
references.

> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
> index f24a5f406746b..bb5f5bddd047d 100644
> --- a/drivers/base/platform.c
> +++ b/drivers/base/platform.c
> @@ -599,7 +599,7 @@ static void platform_device_release(struct device *dev)
>  	struct platform_object *pa = container_of(dev, struct platform_object,
>  						  pdev.dev);
>  
> -	of_node_put(pa->pdev.dev.of_node);
> +	fwnode_handle_put(pa->pdev.dev.fwnode);

[Severity: High]
Does replacing of_node_put() here cause a memory leak of of_node references?

Many drivers and core APIs manually acquire an of_node reference and assign
it directly to pdev->dev.of_node without setting pdev->dev.fwnode. For
example, in drivers/base/core.c:device_set_of_node_from_dev():

	of_node_put(dev->of_node);
	dev->of_node = of_node_get(dev2->of_node);

When a platform device set up this way is released, fwnode_handle_put() will
operate on a NULL or unrelated fwnode, failing to drop the of_node reference.

[Severity: High]
Can this fwnode_handle_put() cause a refcount underflow for software nodes?

Platform drivers often inherit their parent's fwnode without taking an
additional reference. For example, in drivers/gpio/gpio-arizona.c:

	device_set_node(&pdev->dev, dev_fwnode(pdev->dev.parent));

Before this patch, calling of_node_put(dev->of_node) on a software node was
a safe no-op (as of_node was NULL). Unconditionally calling
fwnode_handle_put() here will now invoke software_node_put() and decrement
the unacquired reference, potentially leading to a use-after-free when the
device is unregistered.

>  	kfree(pa->pdev.dev.platform_data);
>  	kfree(pa->pdev.mfd_cell);
>  	kfree(pa->pdev.resource);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629-pdev-fwnode-ref-v2-0-8abe2513f96e@oss.qualcomm.com?part=19