[PATCH v2 0/2] PCI: of: Fix OF device node refcount leakages

[PATCH v2 0/2] PCI: of: Fix OF device node refcount leakages

[Zijun Hu]

This patch series is to fix OF device node refcount leakage for
 - of_irq_parse_and_map_pci()
 - of_pci_prop_intr_map()

Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
---
Similar fixes within mainline:
Commit: 962a2805e47b ("of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()")
Commit: ff93e7213d6c ("of/irq: Fix device node refcount leakage in API of_irq_parse_raw()")

---
Changes in v2:
- Change author mail
- Link to v1: https://lore.kernel.org/r/20250407-fix_of_pci-v1-0-a14d981fd148@quicinc.com

---
Zijun Hu (2):
      PCI: of: Fix OF device node refcount leakage in API of_irq_parse_and_map_pci()
      PCI: of: Fix OF device node refcount leakages in of_pci_prop_intr_map()

 drivers/pci/of.c          |  2 ++
 drivers/pci/of_property.c | 20 +++++++++++---------
 2 files changed, 13 insertions(+), 9 deletions(-)
---
base-commit: c10ba24fb5c9d6e2eb595bf7a0a00fda8f265a0b
change-id: 20250407-fix_of_pci-20b45dcc26b5

Best regards,
-- 
Zijun Hu <zijun.hu@oss.qualcomm.com>

[PATCH v2 1/2] PCI: of: Fix OF device node refcount leakage in API of_irq_parse_and_map_pci()

[Zijun Hu]

From: Zijun Hu <zijun.hu@oss.qualcomm.com>

Successful of_irq_parse_pci() invocation will increase refcount of
OF device node @oirq.np, but API of_irq_parse_and_map_pci() does not
decrease the refcount before return, so cause @oirq.np refcount leakage.

Fix by using OF __free() to decrease the refcount.

Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Cc: Rob Herring (Arm) <robh@kernel.org>
---
 drivers/pci/of.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/of.c b/drivers/pci/of.c
index 3579265f119845637e163d9051437c89662762f8..fd6596b251246c3b64b2558c67652d01f142c785 100644
--- a/drivers/pci/of.c
+++ b/drivers/pci/of.c
@@ -576,6 +576,7 @@ static int of_irq_parse_pci(const struct pci_dev *pdev, struct of_phandle_args *
  */
 int of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin)
 {
+	struct device_node *np __free(device_node) = NULL;
 	struct of_phandle_args oirq;
 	int ret;
 
@@ -583,6 +584,7 @@ int of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin)
 	if (ret)
 		return 0; /* Proper return code 0 == NO_IRQ */
 
+	np = oirq.np;
 	return irq_create_of_mapping(&oirq);
 }
 EXPORT_SYMBOL_GPL(of_irq_parse_and_map_pci);

-- 
2.34.1

[PATCH v2 2/2] PCI: of: Fix OF device node refcount leakages in of_pci_prop_intr_map()

[Zijun Hu]

From: Zijun Hu <zijun.hu@oss.qualcomm.com>

Successful of_irq_parse_raw() invocation will increase refcount
of OF device node @out_irq[].np, but of_pci_prop_intr_map() does
not decrease the refcount before return, so cause @out_irq[].np
refcount leakages.

Fix by putting @out_irq[].np refcount before return.

Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
Cc: Rob Herring (Arm) <robh@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
---
 drivers/pci/of_property.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c
index 506fcd5071139e0c11130f4c36f5082ed9789efb..4250a78fafbec4c29af124d7ba5ece7b0b785fb3 100644
--- a/drivers/pci/of_property.c
+++ b/drivers/pci/of_property.c
@@ -258,12 +258,16 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev, struct of_changeset *ocs,
 	 * Parsing interrupt failed for all pins. In this case, it does not
 	 * need to generate interrupt-map property.
 	 */
-	if (!map_sz)
-		return 0;
+	if (!map_sz) {
+		ret = 0;
+		goto out_put_nodes;
+	}
 
 	int_map = kcalloc(map_sz, sizeof(u32), GFP_KERNEL);
-	if (!int_map)
-		return -ENOMEM;
+	if (!int_map) {
+		ret = -ENOMEM;
+		goto out_put_nodes;
+	}
 	mapp = int_map;
 
 	list_for_each_entry(child, &pdev->subordinate->devices, bus_list) {
@@ -305,14 +309,12 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev, struct of_changeset *ocs,
 	ret = of_changeset_add_prop_u32_array(ocs, np, "interrupt-map-mask",
 					      int_map_mask,
 					      ARRAY_SIZE(int_map_mask));
-	if (ret)
-		goto failed;
-
-	kfree(int_map);
-	return 0;
 
 failed:
 	kfree(int_map);
+out_put_nodes:
+	for (i = 0; i < OF_PCI_MAX_INT_PIN; i++)
+		of_node_put(out_irq[i].np);
 	return ret;
 }
 

-- 
2.34.1