[PATCH] pmdomain: mediatek: fix remaining %pOF after of_node_put()

[Ulf Hansson]

On Wed, Jul 8, 2026 at 11:23 AM Guangshuo Li <lgs201920130244 at gmail.com> wrote:
>
> scpsys_get_bus_protection_legacy() looks up several legacy bus
> protection regmaps from device-tree nodes.
>
> Two error paths put the device node before checking whether the regmap
> lookup failed, but still pass that node to dev_err_probe() with %pOF on
> failure. If of_node_put() drops the last reference, the later %pOF
> formatting can dereference a freed device node.
>
> Keep the node reference until after the error message has been emitted in
> the infracfg and SMI lookup paths. Also drop the SMI node before
> returning when the SMI phandle is missing.
>
> Fixes: c29345fa5f66 ("pmdomain: mediatek: Refactor bus protection regmaps retrieval")
> Signed-off-by: Guangshuo Li <lgs201920130244 at gmail.com>

Applied for fixes and by adding a stable tag, thanks!

Kind regards
Uffe


> ---
>  drivers/pmdomain/mediatek/mtk-pm-domains.c | 22 +++++++++++++++-------
>  1 file changed, 15 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/pmdomain/mediatek/mtk-pm-domains.c b/drivers/pmdomain/mediatek/mtk-pm-domains.c
> index e1cfd4223473..f877d6694dd5 100644
> --- a/drivers/pmdomain/mediatek/mtk-pm-domains.c
> +++ b/drivers/pmdomain/mediatek/mtk-pm-domains.c
> @@ -1032,12 +1032,15 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s
>         node = of_find_node_with_property(np, "mediatek,infracfg");
>         if (node) {
>                 regmap[0] = syscon_regmap_lookup_by_phandle(node, "mediatek,infracfg");
> -               of_node_put(node);
>                 num_regmaps++;
> -               if (IS_ERR(regmap[0]))
> -                       return dev_err_probe(dev, PTR_ERR(regmap[0]),
> +               if (IS_ERR(regmap[0])) {
> +                       ret = dev_err_probe(dev, PTR_ERR(regmap[0]),
>                                              "%pOF: failed to get infracfg regmap\n",
>                                              node);
> +                       of_node_put(node);
> +                       return ret;
> +               }
> +               of_node_put(node);
>         } else {
>                 regmap[0] = NULL;
>         }
> @@ -1046,17 +1049,22 @@ static int scpsys_get_bus_protection_legacy(struct device *dev, struct scpsys *s
>         node = of_find_node_with_property(np, "mediatek,smi");
>         if (node) {
>                 smi_np = of_parse_phandle(node, "mediatek,smi", 0);
> -               of_node_put(node);
> -               if (!smi_np)
> +               if (!smi_np) {
> +                       of_node_put(node);
>                         return -ENODEV;
> +               }
>
>                 regmap[1] = device_node_to_regmap(smi_np);
>                 num_regmaps++;
>                 of_node_put(smi_np);
> -               if (IS_ERR(regmap[1]))
> -                       return dev_err_probe(dev, PTR_ERR(regmap[1]),
> +               if (IS_ERR(regmap[1])) {
> +                       ret = dev_err_probe(dev, PTR_ERR(regmap[1]),
>                                              "%pOF: failed to get SMI regmap\n",
>                                              node);
> +                       of_node_put(node);
> +                       return ret;
> +               }
> +               of_node_put(node);
>         } else {
>                 regmap[1] = NULL;
>         }
> --
> 2.43.0
>