In a6xx_gpu_init(), node is obtained via of_parse_phandle().
While there was a manual of_node_put() at the end of the
common path, several early error returns would bypass this call,
resulting in a reference leak.
Fix this by using the __free(device_node) cleanup handler to
release the reference when the variable goes out of scope.

Fixes: 5a903a44a984 ("drm/msm/a6xx: Introduce GMU wrapper support")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
---
 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
index 2129d230a92b..0bc518d9fd65 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
@@ -2640,7 +2640,6 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
 	struct msm_drm_private *priv = dev->dev_private;
 	struct platform_device *pdev = priv->gpu_pdev;
 	struct adreno_platform_config *config = pdev->dev.platform_data;
-	struct device_node *node;
 	struct a6xx_gpu *a6xx_gpu;
 	struct adreno_gpu *adreno_gpu;
 	struct msm_gpu *gpu;
@@ -2660,7 +2659,8 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
 	adreno_gpu->registers = NULL;
 
 	/* Check if there is a GMU phandle and set it up */
-	node = of_parse_phandle(pdev->dev.of_node, "qcom,gmu", 0);
+	struct device_node *node __free(device_node) =
+		of_parse_phandle(pdev->dev.of_node, "qcom,gmu", 0);
 	/* FIXME: How do we gracefully handle this? */
 	BUG_ON(!node);
 
@@ -2702,7 +2702,6 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
 		ret = a6xx_gmu_wrapper_init(a6xx_gpu, node);
 	else
 		ret = a6xx_gmu_init(a6xx_gpu, node);
-	of_node_put(node);
 	if (ret) {
 		a6xx_destroy(&(a6xx_gpu->base.base));
 		return ERR_PTR(ret);

---
base-commit: a0c666c25aeefd16f4b088c6549a6fb6b65a8a1d
change-id: 20260123-a6xx_gpu-cbc095dbe423

Best regards,
-- 
Felix Gu <ustc.gu@gmail.com>

On Sat, Jan 24, 2026 at 12:37:38AM +0800, Felix Gu wrote:
> In a6xx_gpu_init(), node is obtained via of_parse_phandle().
> While there was a manual of_node_put() at the end of the
> common path, several early error returns would bypass this call,
> resulting in a reference leak.
> Fix this by using the __free(device_node) cleanup handler to
> release the reference when the variable goes out of scope.
> 
> Fixes: 5a903a44a984 ("drm/msm/a6xx: Introduce GMU wrapper support")
> Signed-off-by: Felix Gu <ustc.gu@gmail.com>
> ---
>  drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> index 2129d230a92b..0bc518d9fd65 100644
> --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> @@ -2640,7 +2640,6 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
>  	struct msm_drm_private *priv = dev->dev_private;
>  	struct platform_device *pdev = priv->gpu_pdev;
>  	struct adreno_platform_config *config = pdev->dev.platform_data;
> -	struct device_node *node;
>  	struct a6xx_gpu *a6xx_gpu;
>  	struct adreno_gpu *adreno_gpu;
>  	struct msm_gpu *gpu;
> @@ -2660,7 +2659,8 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
>  	adreno_gpu->registers = NULL;
>  
>  	/* Check if there is a GMU phandle and set it up */
> -	node = of_parse_phandle(pdev->dev.of_node, "qcom,gmu", 0);
> +	struct device_node *node __free(device_node) =
> +		of_parse_phandle(pdev->dev.of_node, "qcom,gmu", 0);

Missing include for cleanup.h.

>  	/* FIXME: How do we gracefully handle this? */
>  	BUG_ON(!node);
>  
> @@ -2702,7 +2702,6 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
>  		ret = a6xx_gmu_wrapper_init(a6xx_gpu, node);
>  	else
>  		ret = a6xx_gmu_init(a6xx_gpu, node);
> -	of_node_put(node);
>  	if (ret) {
>  		a6xx_destroy(&(a6xx_gpu->base.base));
>  		return ERR_PTR(ret);
> 
> ---
> base-commit: a0c666c25aeefd16f4b088c6549a6fb6b65a8a1d
> change-id: 20260123-a6xx_gpu-cbc095dbe423
> 
> Best regards,
> -- 
> Felix Gu <ustc.gu@gmail.com>
> 

-- 
With best wishes
Dmitry

Hi Dmitry,
Thanks for your review.
linux/cleanup.h is included in linux/of.h.
So it should be included already.

Best regards,
Feix Gu

On Sat, Jan 24, 2026 at 1:58 AM Dmitry Baryshkov
<dmitry.baryshkov@oss.qualcomm.com> wrote:
>
> On Sat, Jan 24, 2026 at 12:37:38AM +0800, Felix Gu wrote:
> > In a6xx_gpu_init(), node is obtained via of_parse_phandle().
> > While there was a manual of_node_put() at the end of the
> > common path, several early error returns would bypass this call,
> > resulting in a reference leak.
> > Fix this by using the __free(device_node) cleanup handler to
> > release the reference when the variable goes out of scope.
> >
> > Fixes: 5a903a44a984 ("drm/msm/a6xx: Introduce GMU wrapper support")
> > Signed-off-by: Felix Gu <ustc.gu@gmail.com>
> > ---
> >  drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 5 ++---
> >  1 file changed, 2 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > index 2129d230a92b..0bc518d9fd65 100644
> > --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> > @@ -2640,7 +2640,6 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
> >       struct msm_drm_private *priv = dev->dev_private;
> >       struct platform_device *pdev = priv->gpu_pdev;
> >       struct adreno_platform_config *config = pdev->dev.platform_data;
> > -     struct device_node *node;
> >       struct a6xx_gpu *a6xx_gpu;
> >       struct adreno_gpu *adreno_gpu;
> >       struct msm_gpu *gpu;
> > @@ -2660,7 +2659,8 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
> >       adreno_gpu->registers = NULL;
> >
> >       /* Check if there is a GMU phandle and set it up */
> > -     node = of_parse_phandle(pdev->dev.of_node, "qcom,gmu", 0);
> > +     struct device_node *node __free(device_node) =
> > +             of_parse_phandle(pdev->dev.of_node, "qcom,gmu", 0);
>
> Missing include for cleanup.h.
>
> >       /* FIXME: How do we gracefully handle this? */
> >       BUG_ON(!node);
> >
> > @@ -2702,7 +2702,6 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
> >               ret = a6xx_gmu_wrapper_init(a6xx_gpu, node);
> >       else
> >               ret = a6xx_gmu_init(a6xx_gpu, node);
> > -     of_node_put(node);
> >       if (ret) {
> >               a6xx_destroy(&(a6xx_gpu->base.base));
> >               return ERR_PTR(ret);
> >
> > ---
> > base-commit: a0c666c25aeefd16f4b088c6549a6fb6b65a8a1d
> > change-id: 20260123-a6xx_gpu-cbc095dbe423
> >
> > Best regards,
> > --
> > Felix Gu <ustc.gu@gmail.com>
> >
>
> --
> With best wishes
> Dmitry

On 23/01/2026 20:21, Felix Gu wrote:
> Hi Dmitry,
> Thanks for your review.
> linux/cleanup.h is included in linux/of.h.
> So it should be included already.

Yes. However we should not depend on include files being provided by 
other kernel-wide includes.

Also, please don't top-post when replying to the emails on public MLs.

> 
> Best regards,
> Feix Gu
> 
> On Sat, Jan 24, 2026 at 1:58 AM Dmitry Baryshkov
> <dmitry.baryshkov@oss.qualcomm.com> wrote:
>>
>> On Sat, Jan 24, 2026 at 12:37:38AM +0800, Felix Gu wrote:
>>> In a6xx_gpu_init(), node is obtained via of_parse_phandle().
>>> While there was a manual of_node_put() at the end of the
>>> common path, several early error returns would bypass this call,
>>> resulting in a reference leak.
>>> Fix this by using the __free(device_node) cleanup handler to
>>> release the reference when the variable goes out of scope.
>>>
>>> Fixes: 5a903a44a984 ("drm/msm/a6xx: Introduce GMU wrapper support")
>>> Signed-off-by: Felix Gu <ustc.gu@gmail.com>
>>> ---
>>>   drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 5 ++---
>>>   1 file changed, 2 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
>>> index 2129d230a92b..0bc518d9fd65 100644
>>> --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
>>> +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
>>> @@ -2640,7 +2640,6 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
>>>        struct msm_drm_private *priv = dev->dev_private;
>>>        struct platform_device *pdev = priv->gpu_pdev;
>>>        struct adreno_platform_config *config = pdev->dev.platform_data;
>>> -     struct device_node *node;
>>>        struct a6xx_gpu *a6xx_gpu;
>>>        struct adreno_gpu *adreno_gpu;
>>>        struct msm_gpu *gpu;
>>> @@ -2660,7 +2659,8 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
>>>        adreno_gpu->registers = NULL;
>>>
>>>        /* Check if there is a GMU phandle and set it up */
>>> -     node = of_parse_phandle(pdev->dev.of_node, "qcom,gmu", 0);
>>> +     struct device_node *node __free(device_node) =
>>> +             of_parse_phandle(pdev->dev.of_node, "qcom,gmu", 0);
>>
>> Missing include for cleanup.h.
>>
>>>        /* FIXME: How do we gracefully handle this? */
>>>        BUG_ON(!node);
>>>
>>> @@ -2702,7 +2702,6 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
>>>                ret = a6xx_gmu_wrapper_init(a6xx_gpu, node);
>>>        else
>>>                ret = a6xx_gmu_init(a6xx_gpu, node);
>>> -     of_node_put(node);
>>>        if (ret) {
>>>                a6xx_destroy(&(a6xx_gpu->base.base));
>>>                return ERR_PTR(ret);
>>>
>>> ---
>>> base-commit: a0c666c25aeefd16f4b088c6549a6fb6b65a8a1d
>>> change-id: 20260123-a6xx_gpu-cbc095dbe423
>>>
>>> Best regards,
>>> --
>>> Felix Gu <ustc.gu@gmail.com>
>>>
>>
>> --
>> With best wishes
>> Dmitry


-- 
With best wishes
Dmitry

On Sat, Jan 24, 2026 at 2:23 AM Dmitry Baryshkov
<dmitry.baryshkov@oss.qualcomm.com> wrote:
>
> On 23/01/2026 20:21, Felix Gu wrote:
> > Hi Dmitry,
> > Thanks for your review.
> > linux/cleanup.h is included in linux/of.h.
> > So it should be included already.
>
> Yes. However we should not depend on include files being provided by
> other kernel-wide includes.
Understood, I will send out V2 to fix it.
>
> Also, please don't top-post when replying to the emails on public MLs.
Sorry for that, thanks for coaching.

Best regards,
Felix Gu

>
> >
> > Best regards,
> > Feix Gu
> >
> > On Sat, Jan 24, 2026 at 1:58 AM Dmitry Baryshkov
> > <dmitry.baryshkov@oss.qualcomm.com> wrote:
> >>
> >> On Sat, Jan 24, 2026 at 12:37:38AM +0800, Felix Gu wrote:
> >>> In a6xx_gpu_init(), node is obtained via of_parse_phandle().
> >>> While there was a manual of_node_put() at the end of the
> >>> common path, several early error returns would bypass this call,
> >>> resulting in a reference leak.
> >>> Fix this by using the __free(device_node) cleanup handler to
> >>> release the reference when the variable goes out of scope.
> >>>
> >>> Fixes: 5a903a44a984 ("drm/msm/a6xx: Introduce GMU wrapper support")
> >>> Signed-off-by: Felix Gu <ustc.gu@gmail.com>
> >>> ---
> >>>   drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 5 ++---
> >>>   1 file changed, 2 insertions(+), 3 deletions(-)
> >>>
> >>> diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> >>> index 2129d230a92b..0bc518d9fd65 100644
> >>> --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> >>> +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
> >>> @@ -2640,7 +2640,6 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
> >>>        struct msm_drm_private *priv = dev->dev_private;
> >>>        struct platform_device *pdev = priv->gpu_pdev;
> >>>        struct adreno_platform_config *config = pdev->dev.platform_data;
> >>> -     struct device_node *node;
> >>>        struct a6xx_gpu *a6xx_gpu;
> >>>        struct adreno_gpu *adreno_gpu;
> >>>        struct msm_gpu *gpu;
> >>> @@ -2660,7 +2659,8 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
> >>>        adreno_gpu->registers = NULL;
> >>>
> >>>        /* Check if there is a GMU phandle and set it up */
> >>> -     node = of_parse_phandle(pdev->dev.of_node, "qcom,gmu", 0);
> >>> +     struct device_node *node __free(device_node) =
> >>> +             of_parse_phandle(pdev->dev.of_node, "qcom,gmu", 0);
> >>
> >> Missing include for cleanup.h.
> >>
> >>>        /* FIXME: How do we gracefully handle this? */
> >>>        BUG_ON(!node);
> >>>
> >>> @@ -2702,7 +2702,6 @@ static struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
> >>>                ret = a6xx_gmu_wrapper_init(a6xx_gpu, node);
> >>>        else
> >>>                ret = a6xx_gmu_init(a6xx_gpu, node);
> >>> -     of_node_put(node);
> >>>        if (ret) {
> >>>                a6xx_destroy(&(a6xx_gpu->base.base));
> >>>                return ERR_PTR(ret);
> >>>
> >>> ---
> >>> base-commit: a0c666c25aeefd16f4b088c6549a6fb6b65a8a1d
> >>> change-id: 20260123-a6xx_gpu-cbc095dbe423
> >>>
> >>> Best regards,
> >>> --
> >>> Felix Gu <ustc.gu@gmail.com>
> >>>
> >>
> >> --
> >> With best wishes
> >> Dmitry
>
>
> --
> With best wishes
> Dmitry