[PATCH] remoteproc: qcom_q6v5_mss: Release OF node references in init_mem

[PATCH] remoteproc: qcom_q6v5_mss: Release OF node references in init_mem

[Anup Vishwakarma]

q6v5_init_mem() parses the qcom,qaccept-regs and qcom,ext-regs
(index 1) properties with of_parse_phandle_with_fixed_args(), which
takes a reference on the returned device-tree node. The two blocks
copy the integer arguments and never release the node, unlike the
other parse blocks in the function, which call of_node_put() once the
node is no longer needed.

Release the node once the arguments have been copied. The leak
affects SC7280 boards whose device tree sets these properties.

Fixes: c842379d00f1 ("remoteproc: mss: q6v5-mss: Add modem support on SC7280")
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
---
 drivers/remoteproc/qcom_q6v5_mss.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
index 2f71ed2feff6..e7ea5e838602 100644
--- a/drivers/remoteproc/qcom_q6v5_mss.c
+++ b/drivers/remoteproc/qcom_q6v5_mss.c
@@ -1846,6 +1846,7 @@ static int q6v5_init_mem(struct q6v5 *qproc, struct platform_device *pdev)
 		qproc->qaccept_mdm = args.args[0];
 		qproc->qaccept_cx = args.args[1];
 		qproc->qaccept_axi = args.args[2];
+		of_node_put(args.np);
 	}
 
 	if (qproc->has_ext_bhs_reg) {
@@ -1892,6 +1893,7 @@ static int q6v5_init_mem(struct q6v5 *qproc, struct platform_device *pdev)
 
 		qproc->axim1_clk_off = args.args[0];
 		qproc->crypto_clk_off = args.args[1];
+		of_node_put(args.np);
 	}
 
 	if (qproc->has_spare_reg) {

---
base-commit: ddfe51b0a0f5dc9e415cc2c8ad8db17532dd426b
change-id: 20261106-b4-q6v5_mss_of_refs-edf890e18e4a

Best regards,
--  
Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>

Re: [PATCH] remoteproc: qcom_q6v5_mss: Release OF node references in init_mem

[Bjorn Andersson]

On Fri, 06 Nov 2026 23:15:50 +0530, Anup Vishwakarma wrote:
> q6v5_init_mem() parses the qcom,qaccept-regs and qcom,ext-regs
> (index 1) properties with of_parse_phandle_with_fixed_args(), which
> takes a reference on the returned device-tree node. The two blocks
> copy the integer arguments and never release the node, unlike the
> other parse blocks in the function, which call of_node_put() once the
> node is no longer needed.
> 
> [...]

Applied, thanks!

[1/1] remoteproc: qcom_q6v5_mss: Release OF node references in init_mem
      commit: dfcd5046c3b434107c72f21fc32d6226bf281f4a

Best regards,
-- 
Bjorn Andersson <andersson@kernel.org>