On Tue, Oct 13, 2026 at 10:47:44AM +0300, Avi Weiss wrote:
> mtk_rpmsg_match_device_subnode() returns a referenced OF child
> node, which is stored in rpdev->dev.of_node.
>
> mtk_rpmsg_release_device() later frees the containing allocation
> without dropping that ref.
>
> Release the OF node when the RPMsg device is destroyed.
>
> Fixes: 7017996951fd ("rpmsg: add rpmsg support for mt8183 SCP.")
> Signed-off-by: Avi Weiss <[email protected]>
> ---
> drivers/rpmsg/mtk_rpmsg.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/rpmsg/mtk_rpmsg.c b/drivers/rpmsg/mtk_rpmsg.c
> index 1b670ed54cfa2..430a9b2aa7bb9 100644
> --- a/drivers/rpmsg/mtk_rpmsg.c
> +++ b/drivers/rpmsg/mtk_rpmsg.c
> @@ -168,6 +168,7 @@ static void mtk_rpmsg_release_device(struct device *dev)
> struct rpmsg_device *rpdev = to_rpmsg_device(dev);
> struct mtk_rpmsg_device *mdev = to_mtk_rpmsg_device(rpdev);
>
> + of_node_put(dev->of_node);
> kfree(mdev);
> }
Applied.
Thanks,
Mathieu
>
>
> base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
> --
> 2.43.0
>