From b24c12e1bad863d27141e4e9c19d25eebd68c4a6 Mon Sep 17 00:00:00 2001 From: Yuho Choi Date: Mon, 15 Jun 2026 13:45:35 -0400 Subject: [PATCH 1/7] ARM: imx: avic: Fix OF node reference leaks of_find_compatible_node() returns a device node with its reference count incremented. mxc_init_irq() looks up the i.MX25 CCM node for of_iomap() and the AVIC node for irq_domain_create_legacy(), but does not release either temporary reference. of_iomap() does not consume the node reference, and irq_domain_create_legacy() takes its own fwnode reference for the domain. Drop the temporary OF node references after each use. Fixes: 9b454d16e57d ("ARM: imx: avic: set low-power interrupt mask for imx25") Fixes: 544496ab5cbd ("ARM: imx: move irq_domain_add_legacy call into avic driver") Signed-off-by: Yuho Choi Reviewed-by: Martin Kaiser Signed-off-by: Frank Li --- arch/arm/mach-imx/avic.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/mach-imx/avic.c b/arch/arm/mach-imx/avic.c index 3067c06b4b8e..6873a50bbe2c 100644 --- a/arch/arm/mach-imx/avic.c +++ b/arch/arm/mach-imx/avic.c @@ -173,6 +173,7 @@ static void __init mxc_init_irq(void __iomem *irqbase) np = of_find_compatible_node(NULL, NULL, "fsl,imx25-ccm"); mx25_ccm_base = of_iomap(np, 0); + of_node_put(np); if (mx25_ccm_base) { /* @@ -203,6 +204,7 @@ static void __init mxc_init_irq(void __iomem *irqbase) np = of_find_compatible_node(NULL, NULL, "fsl,avic"); domain = irq_domain_create_legacy(of_fwnode_handle(np), AVIC_NUM_IRQS, irq_base, 0, &irq_domain_simple_ops, NULL); + of_node_put(np); WARN_ON(!domain); for (i = 0; i < AVIC_NUM_IRQS / 32; i++, irq_base += 32) From 936407c3563ac745cbbb9953c0cf2472128a22f4 Mon Sep 17 00:00:00 2001 From: Weigang He Date: Wed, 10 Jun 2026 15:06:24 +1000 Subject: [PATCH 2/7] ARM: imx: fix device_node refcount leak in imx_src_init() imx_src_init() obtains a device_node reference via of_find_compatible_node() matching "fsl,imx51-src" and uses it only to call of_iomap(). It never releases that reference: on the success path the function returns at the end without of_node_put(np), leaking one device_node refcount on every boot of an i.MX5/6 platform. Release the reference right after of_iomap(). of_iomap() maps the node's registers but does not retain a reference to the device_node, so the node can be put once the mapping is done. The early return on a NULL np needs no put. Found by static analysis tool CodeQL. Fixes: bd3d924d71a4 ("ARM i.MX5: Add System Reset Controller (SRC) support for i.MX51 and i.MX53") Signed-off-by: Weigang He Signed-off-by: Frank Li --- arch/arm/mach-imx/src.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mach-imx/src.c b/arch/arm/mach-imx/src.c index 59a8e8cc4469..f28bfb653a88 100644 --- a/arch/arm/mach-imx/src.c +++ b/arch/arm/mach-imx/src.c @@ -171,6 +171,7 @@ void __init imx_src_init(void) if (!np) return; src_base = of_iomap(np, 0); + of_node_put(np); WARN_ON(!src_base); /* From 3de939b2ac843d56d88e2ab1e1b1f667cba9e1d4 Mon Sep 17 00:00:00 2001 From: Weigang He Date: Wed, 10 Jun 2026 15:06:25 +1000 Subject: [PATCH 3/7] ARM: imx: fix device_node refcount leaks in imx7_src_init() imx7_src_init() obtains two device_node references via of_find_compatible_node() - one for "fsl,imx7d-src" and one for "fsl,imx7d-gpc" - reusing the same np variable, but never calls of_node_put() on either. On every i.MX7D boot up to two device_node refcounts are leaked: - The "fsl,imx7d-src" node is leaked both when of_iomap() fails (the early return after the mapping) and when it succeeds, because np is then overwritten by the second of_find_compatible_node() call without releasing the prior reference. - The "fsl,imx7d-gpc" node is leaked on every path leaving the function after it is acquired. Release each reference immediately after of_iomap() consumes the node. of_iomap() maps the node's registers but does not retain a reference to the device_node, so it is safe to put the node once mapped; this also drops the first reference before np is reused for the second lookup. Found by static analysis tool CodeQL. Fixes: e34645f45805 ("ARM: imx: add smp support for imx7d") Signed-off-by: Weigang He Signed-off-by: Frank Li --- arch/arm/mach-imx/src.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/mach-imx/src.c b/arch/arm/mach-imx/src.c index f28bfb653a88..c3c80b4c3d53 100644 --- a/arch/arm/mach-imx/src.c +++ b/arch/arm/mach-imx/src.c @@ -196,6 +196,7 @@ void __init imx7_src_init(void) return; src_base = of_iomap(np, 0); + of_node_put(np); if (!src_base) return; @@ -204,6 +205,7 @@ void __init imx7_src_init(void) return; gpc_base = of_iomap(np, 0); + of_node_put(np); if (!gpc_base) return; } From 4cf26bc2e7e099c86127d63ed7272753da45737e Mon Sep 17 00:00:00 2001 From: Li Jun Date: Wed, 10 Jun 2026 08:38:14 +0800 Subject: [PATCH 4/7] firmware: imx: sm-misc: Add NULL check for kmalloc in syslog_show Add a proper NULL check for the kmalloc() return value in syslog_show(). If memory allocation fails, syslog would be NULL and passing it to misc_syslog() could lead to a NULL pointer dereference. Fixes: 80a4062e8821 ("firmware: imx: sm-misc: Dump syslog info") Signed-off-by: Li Jun Signed-off-by: Frank Li --- drivers/firmware/imx/sm-misc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/firmware/imx/sm-misc.c b/drivers/firmware/imx/sm-misc.c index ac9af824c2d4..fb8d7bdb5b08 100644 --- a/drivers/firmware/imx/sm-misc.c +++ b/drivers/firmware/imx/sm-misc.c @@ -79,6 +79,9 @@ static int syslog_show(struct seq_file *file, void *priv) u16 size = SZ_4K / 4; int ret; + if (!syslog) + return -ENOMEM; + if (!ph) return -ENODEV; From 9818b99c128d4ee648c637dfb2dc7bff9256923b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Tue, 23 Jun 2026 12:45:57 +0200 Subject: [PATCH 5/7] ARM: imx: Drop obsolete stuff from common.h MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit i.MX21 (and thus imx21_init_early()) is gone since v5.10-rc1 (commit 4b563a066611 ("ARM: imx: Remove imx21 support")). The init_irq() functions are gone since v5.12-rc5 (commit e2c1b0ff38c9 ("ARM: imx: avic: Convert to using IRQCHIP_DECLARE")). And mxc_device_init() was removed for v5.10-rc1 (in commit 8485adf17a15 ("ARM: imx: Remove imx device directory")). The last user of imx1_reset_init() is gone since v4.9-rc1 (commit e1291cffcc50 ("ARM: i.MX: Remove i.MX1 non-DT support")). Drop declaration of enum mxc_cpu_pwr_mode, the actual definition follows later in common.h without a usage in-between. All users of of_device_id also include , or which is enough to not need the forward declaration. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Frank Li Signed-off-by: Frank Li --- arch/arm/mach-imx/common.h | 7 ------- arch/arm/mach-imx/system.c | 8 -------- 2 files changed, 15 deletions(-) diff --git a/arch/arm/mach-imx/common.h b/arch/arm/mach-imx/common.h index 45c1a2a7b35f..d7ecaa822adb 100644 --- a/arch/arm/mach-imx/common.h +++ b/arch/arm/mach-imx/common.h @@ -14,23 +14,16 @@ struct platform_device; struct pt_regs; struct clk; struct device_node; -enum mxc_cpu_pwr_mode; -struct of_device_id; void mx31_map_io(void); void mx35_map_io(void); -void imx21_init_early(void); void imx31_init_early(void); void imx35_init_early(void); -void mx31_init_irq(void); -void mx35_init_irq(void); void mxc_set_cpu_type(unsigned int type); void mxc_restart(enum reboot_mode, const char *); void mxc_arch_reset_init(void __iomem *); -void imx1_reset_init(void __iomem *); void imx_set_aips(void __iomem *); void imx_aips_allow_unprivileged_access(const char *compat); -int mxc_device_init(void); void imx_set_soc_revision(unsigned int rev); void imx_init_revision_from_anatop(void); void imx6_enable_rbc(bool enable); diff --git a/arch/arm/mach-imx/system.c b/arch/arm/mach-imx/system.c index e88ca027129d..1afae485f203 100644 --- a/arch/arm/mach-imx/system.c +++ b/arch/arm/mach-imx/system.c @@ -74,14 +74,6 @@ void __init mxc_arch_reset_init(void __iomem *base) clk_prepare(wdog_clk); } -#ifdef CONFIG_SOC_IMX1 -void __init imx1_reset_init(void __iomem *base) -{ - wcr_enable = (1 << 0); - mxc_arch_reset_init(base); -} -#endif - #ifdef CONFIG_CACHE_L2X0 void __init imx_init_l2cache(void) { From 116165611d4d287ae58992528ba779133e7c72b3 Mon Sep 17 00:00:00 2001 From: Griffin Kroah-Hartman Date: Mon, 6 Jul 2026 17:01:11 +0200 Subject: [PATCH 6/7] soc: imx9: devm_kasprintf error handling Add error handling to devm_kasprintf functions in imx9_soc_probe(). Assisted-by: gkh_clanker_2000 Cc: Frank Li Cc: Sascha Hauer Cc: Pengutronix Kernel Team Cc: Fabio Estevam Cc: Peng Fan Cc: Shawn Guo Cc: Bartosz Golaszewski Signed-off-by: Griffin Kroah-Hartman Signed-off-by: Greg Kroah-Hartman Signed-off-by: Frank Li --- drivers/soc/imx/soc-imx9.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/soc/imx/soc-imx9.c b/drivers/soc/imx/soc-imx9.c index 58eef7d4f908..23b54b7d7502 100644 --- a/drivers/soc/imx/soc-imx9.c +++ b/drivers/soc/imx/soc-imx9.c @@ -35,6 +35,8 @@ static int imx9_soc_probe(struct platform_device *pdev) return dev_err_probe(dev, err, "%s: missing model property\n", __func__); attr->family = devm_kasprintf(dev, GFP_KERNEL, "Freescale i.MX"); + if (!attr->family) + return -ENOMEM; /* * Retrieve the soc id, rev & uid info: @@ -52,11 +54,18 @@ static int imx9_soc_probe(struct platform_device *pdev) rev_minor = SOC_REV_MINOR(res.a1); attr->soc_id = devm_kasprintf(dev, GFP_KERNEL, "i.MX%2x", soc_id); + if (!attr->soc_id) + return -ENOMEM; + attr->revision = devm_kasprintf(dev, GFP_KERNEL, "%d.%d", rev_major, rev_minor); + if (!attr->revision) + return -ENOMEM; uid127_64 = res.a2; uid63_0 = res.a3; attr->serial_number = devm_kasprintf(dev, GFP_KERNEL, "%016llx%016llx", uid127_64, uid63_0); + if (!attr->serial_number) + return -ENOMEM; sdev = soc_device_register(attr); if (IS_ERR(sdev)) From 55c748d596f841a18cf659ce0999f64029a5c88c Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Tue, 16 Jun 2026 08:59:01 +0800 Subject: [PATCH 7/7] firmware: imx: scu: manage mailbox channels and global handle imx_scu_probe() requests mailbox channels with the non-managed mbox_request_channel_byname() helper and then publishes sc_ipc through the global imx_sc_ipc_handle. Later probe failures, including child population failure, can leave the channels and global handle live after the probe has failed. Register devres actions to free each mailbox channel and clear the global handle. Also depopulate partially created child devices when devm_of_platform_populate() reports an error. Signed-off-by: Pengpeng Hou Signed-off-by: Frank Li --- drivers/firmware/imx/imx-scu.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/imx/imx-scu.c b/drivers/firmware/imx/imx-scu.c index 67b267a7408a..203aac421252 100644 --- a/drivers/firmware/imx/imx-scu.c +++ b/drivers/firmware/imx/imx-scu.c @@ -82,6 +82,17 @@ static int imx_sc_linux_errmap[IMX_SC_ERR_LAST] = { static struct imx_sc_ipc *imx_sc_ipc_handle; +static void imx_scu_free_mbox_chan(void *data) +{ + mbox_free_channel(data); +} + +static void imx_scu_clear_handle(void *data) +{ + if (imx_sc_ipc_handle == data) + imx_sc_ipc_handle = NULL; +} + static inline int imx_sc_to_linux_errno(int errno) { if (errno >= IMX_SC_ERR_NONE && errno < IMX_SC_ERR_LAST) @@ -321,6 +332,11 @@ static int imx_scu_probe(struct platform_device *pdev) dev_dbg(dev, "request mbox chan %s\n", chan_name); /* chan_name is not used anymore by framework */ kfree(chan_name); + + ret = devm_add_action_or_reset(dev, imx_scu_free_mbox_chan, + sc_chan->ch); + if (ret) + return ret; } sc_ipc->dev = dev; @@ -330,6 +346,9 @@ static int imx_scu_probe(struct platform_device *pdev) init_completion(&sc_ipc->done); imx_sc_ipc_handle = sc_ipc; + ret = devm_add_action_or_reset(dev, imx_scu_clear_handle, sc_ipc); + if (ret) + return ret; ret = imx_scu_soc_init(dev); if (ret) @@ -342,7 +361,11 @@ static int imx_scu_probe(struct platform_device *pdev) dev_info(dev, "NXP i.MX SCU Initialized\n"); - return devm_of_platform_populate(dev); + ret = devm_of_platform_populate(dev); + if (ret) + of_platform_depopulate(dev); + + return ret; } static const struct of_device_id imx_scu_match[] = {