ALSA: aoa: i2sbus: fix OF node lifetime handling

i2sbus_add_dev() keeps the matched "sound" child pointer after
for_each_child_of_node() has dropped the iterator reference. Take an
extra reference before saving that node and drop it after the
layout-id/device-id lookup is complete.

The function also stores np in dev->sound.ofdev.dev.of_node without
taking a reference for the embedded soundbus device. Since i2sbus
overrides the embedded platform device release callback, balance that
reference explicitly in the local error path and in i2sbus_release_dev().

Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260330-aoa-i2sbus-ofnode-lifetime-v1-1-51c309f4ff06@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/aoa/soundbus/i2sbus/core.c b/sound/aoa/soundbus/i2sbus/core.c
index 22c956267f4eb6aabf27e891f032ebd6b6420dd6..833c44c0a9506b18fdc04217c28e80ad092fbd0a 100644 (file)
--- a/sound/aoa/soundbus/i2sbus/core.c
+++ b/sound/aoa/soundbus/i2sbus/core.c
@@ -84,6 +84,7 @@ static void i2sbus_release_dev(struct device *dev)
        for (i = aoa_resource_i2smmio; i <= aoa_resource_rxdbdma; i++)
                free_irq(i2sdev->interrupts[i], i2sdev);
        i2sbus_control_remove_dev(i2sdev->control, i2sdev);
+       of_node_put(i2sdev->sound.ofdev.dev.of_node);
        mutex_destroy(&i2sdev->lock);
        kfree(i2sdev);
 }
@@ -147,7 +148,6 @@ static int i2sbus_get_and_fixup_rsrc(struct device_node *np, int index,
 }
 
 /* Returns 1 if added, 0 for otherwise; don't return a negative value! */
-/* FIXME: look at device node refcounting */
 static int i2sbus_add_dev(struct macio_dev *macio,
                          struct i2sbus_control *control,
                          struct device_node *np)
@@ -178,8 +178,9 @@ static int i2sbus_add_dev(struct macio_dev *macio,
        i = 0;
        for_each_child_of_node(np, child) {
                if (of_node_name_eq(child, "sound")) {
+                       of_node_put(sound);
                        i++;
-                       sound = child;
+                       sound = of_node_get(child);
                }
        }
        if (i == 1) {
@@ -205,6 +206,7 @@ static int i2sbus_add_dev(struct macio_dev *macio,
                        }
                }
        }
+       of_node_put(sound);
        /* for the time being, until we can handle non-layout-id
         * things in some fabric, refuse to attach if there is no
         * layout-id property or we haven't been forced to attach.
@@ -219,7 +221,7 @@ static int i2sbus_add_dev(struct macio_dev *macio,
        mutex_init(&dev->lock);
        spin_lock_init(&dev->low_lock);
        dev->sound.ofdev.archdata.dma_mask = macio->ofdev.archdata.dma_mask;
-       dev->sound.ofdev.dev.of_node = np;
+       dev->sound.ofdev.dev.of_node = of_node_get(np);
        dev->sound.ofdev.dev.dma_mask = &dev->sound.ofdev.archdata.dma_mask;
        dev->sound.ofdev.dev.parent = &macio->ofdev.dev;
        dev->sound.ofdev.dev.release = i2sbus_release_dev;
@@ -327,6 +329,7 @@ static int i2sbus_add_dev(struct macio_dev *macio,
        for (i=0;i<3;i++)
                release_and_free_resource(dev->allocated_resource[i]);
        mutex_destroy(&dev->lock);
+       of_node_put(dev->sound.ofdev.dev.of_node);
        kfree(dev);
        return 0;
 }