Re: [PATCH v1 1/1] device property: Allow secondary lookup in fwnode_get_next_child_node()

[Peter Shier]

On Tue Feb 10, 2026 at 2:58 PM CET, Andy Shevchenko wrote:
> When device_get_child_node_count() got split to the fwnode and device
> respective APIs, the fwnode didn't inherit the ability to traverse over
> the secondary fwnode. Hence any user, that switches from device to fwnode
> API misses this feature. In particular, this was revealed by the commit
> 1490cbb9dbfd ("device property: Split fwnode_get_child_node_count()")
> that effectively broke the GPIO enumeration on Intel Galileo boards.
> Fix this by moving the secondary lookup from device to fwnode API.

I am not familiar with this code at all but from a sashiko AI review I
found the following comments.
Does this need to be addressed?

> diff --git a/drivers/base/property.c b/drivers/base/property.c
> index 837d77e3af2b..4217d00c76fd 100644
> --- a/drivers/base/property.c
> +++ b/drivers/base/property.c
> @@ -759,7 +759,18 @@
>  fwnode_get_next_child_node(const struct fwnode_handle *fwnode,
>     struct fwnode_handle *child)
>  {
> - return fwnode_call_ptr_op(fwnode, get_next_child_node, child);
> + struct fwnode_handle *next;
> +
> + if (IS_ERR_OR_NULL(fwnode))
> + return NULL;
> +
> + /* Try to find a child in primary fwnode */
> + next = fwnode_call_ptr_op(fwnode, get_next_child_node, child);

If the primary fwnode is a Devicetree node (OF) and it returns NULL because
`child` was its last child, `of_fwnode_get_next_child_node()` will have
already called `of_node_put()` on `child`. Will passing this already-freed
`child` pointer to the secondary fwnode below cause a double-put when
`software_node_get_next_child()` also calls `fwnode_handle_put(child)`?

If `child` is a node from the secondary fwnode, passing it to the primary
OF fwnode's `get_next_child_node` operation will result in `to_of_node(child)`
evaluating to NULL. This causes `of_get_next_available_child()` to treat it
as the start of the iteration and return the first primary child. Does this
create an infinite loop where the iteration loops back to the primary children
after reaching a secondary child?

Furthermore, when the primary OF fwnode's `get_next_child_node` treats the
secondary `child` as NULL, it does not drop the reference to `child`. Does
this leak the secondary fwnode child references during the infinite loop?

> + if (next)
> + return next;
> +
> + /* When no more children in primary, continue with secondary */
> + return fwnode_call_ptr_op(fwnode->secondary, get_next_child_node, child);
>  }