From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE64B40D579 for ; Wed, 10 Jun 2026 03:31:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781062266; cv=none; b=DeRXf2Us8cbrLNvGi3Hscscqc17gBmytla87xdifpay9ePWgYYvi+rhg0BpyoQRWd3VSmRw6TKGif2x2dXhVW+NN1OPH8cli1TDjk/S0zIkHsdVV9Yr1jaP5F4zNGuoOUs8mI9UrXf0k3FGri9w+jnIX7VN1rGYZfW5S52O1jEQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781062266; c=relaxed/simple; bh=Fkoye1pTnmv2OWIq+UI5RQBidMdxCZqUmE3NRs5u1VA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=EL8MzGNeBzEkT/JYiMeXMuZm3fC9JVJheR6BFNKqcpEdBQACQIKXFuF73t8Qo9Pbe2GmxhTzZnTQaB72IkPLeayLa7psAQTZQ0Pf3pzsqbjLpKBTzw44d2813OpYbv+F94qyh4fLuDl6+XYVZJv4G1JMTR/aMygQk8+za6f6Rdw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kBSsoKxB; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kBSsoKxB" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-84234c83142so2608474b3a.1 for ; Tue, 09 Jun 2026 20:31:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781062264; x=1781667064; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=QCY5Uiymy7Lwj+bl9lGJdGEWJ7fAXjtQf2ir7UED5Co=; b=kBSsoKxB2tgldkBBnCviISBwrB9jz2S3g+2qgqrxHQ7sY9B4sYfvp26CnwAnu5ErAL Zg4tIUC1Rq41VejNbNWQMjEOpsBSELe5m1BggZlDjtUxGK7uEjOh9/JZ+qLUBsa8nCTQ zmFfiLUucIyOxCMioQQ0wU0Xm9gSAx2R2fxq4RQbaTzg2kdqmtHYx4az+7jJXXxyR/dQ Id8HQlvtQ96t1d7ETUbKQ0kfiiqpbIIbmQYguH5qFI5p5l9Eh4AnXX/Scv6wBclqUkt2 zdjreYxLTBX2Zluapf0GV4gG8EDd11H2u19Ndz1A0wpG7UW+FLwKmM3sh/fsZpFIff8R rE+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781062264; x=1781667064; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=QCY5Uiymy7Lwj+bl9lGJdGEWJ7fAXjtQf2ir7UED5Co=; b=e9vZ7hzOZ/PbT3Uvun3OUICJ5VnhVlF1Jorf5OKI8Q0Ih9k57AADLhfbAwCJwddFsy 7WRoCmQve8MZfRg3fKdu2E299YpfYUvmq1D6oGiFmX44VPF9gYutGyAV1R0ueMWnEY// +DPiQBMefjpP2GJIt++GfgP8c/bLJChoCa5PXeiUFEIDzb8LrzWdquinsRDIUXbL11l4 4TKm+M7HemfmJ/aXPwdHDjQgBqjndwttY590DiyjjLlRokPJ5uOtghK+CpIUONFT73rc ZQGF8Y1omPPO3WdGghZntvPRvLrSbvT6zYbFtjYcLoDRP204Qpq7SvrgYTSz8C9IU+SO XdKw== X-Forwarded-Encrypted: i=1; AFNElJ9HPf5NDtTGS7ahBpmkh9BE+ohnbNjZQRM68EnD80x+bEuH1wvDv3+xbKPgFwPiEOTJzf8fNYy+YDHlXw8=@vger.kernel.org X-Gm-Message-State: AOJu0Ywsy52gOiWdHNk+NGjf4T7humNb7FEAC4TlBL+gdrKMlBePx0l3 VsqI9hXsRpckLzaF6FbD+Wq49KhUorNxBPYUwyh1RKfJ/4fsNdiQ7NITSGz8pk15 X-Gm-Gg: Acq92OH/QY8fyh/n19fJ3ElRIXN9JjMZK1MS08wwCT9MpijteFDa3N22p9yQUqTzlqU F6w24S2WRCpLtACN98iHTJ85cWm/+w05CLWUwHfxD5NVw+owicDhpY98SmNTMP/cdtdk64tR9o+ kTv4eXYO+j1NW6zGKTXGxRvOUJ1XQVrp/v/KIRZjAqMz5KKK0mNj+32UYHmNtLKcTzSzQzjSEFR lCVIJ427gDu0+0OcTVhrfbIqo/YvNSG499oCjivadVsQSb5lp/jD3jT3QrfF2+yWVfZhqEXl3kg 3aWb9TAL/k8WZhEcSmBIFvaRSQHHUlryBcTJ5buizn+19oxwkD4MTLcVtVgHO5OV5tFMT5vz2qj 6Sn0DwiPY/pk/Z+469ljUR/9B3dMAg2FM9VaL2TtlGr8tgfmVGSV46eWQ+nEZPxrNXyioDC4fbX axX3lp7XqPjfZRmJC8eC+uCMbuaN5XuxUMB1SSYfuYA72/sHUntxyajA4XAwG7VNGxTMRCnXdpF dYsYLHRnQ3Ea1XSK0zb+Bcvyu7L/rcKQAVLYZd87GLMVsULYQaXwA== X-Received: by 2002:a05:6a00:1d8b:b0:842:670d:f6ff with SMTP id d2e1a72fcca58-842b0fffad4mr23039121b3a.44.1781062263958; Tue, 09 Jun 2026 20:31:03 -0700 (PDT) Received: from localhost.localdomain (n49-176-80-106.mas22.nsw.optusnet.com.au. [49.176.80.106]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-842828e1e5bsm22455084b3a.46.2026.06.09.20.31.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jun 2026 20:31:03 -0700 (PDT) From: Weigang He To: Liviu Dudau Cc: Sudeep Holla , Lorenzo Pieralisi , Rob Herring , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Weigang He Subject: [PATCH] bus: vexpress-config: fix device_node refcount leak in vexpress_syscfg_probe() Date: Wed, 10 Jun 2026 13:30:54 +1000 Message-ID: <20260610033054.2117363-1-geoffreyhe2@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit vexpress_syscfg_probe() iterates the "arm,vexpress,config-bus" compatible nodes and, for each one, takes a reference to the bridge phandle via of_parse_phandle(): bridge_np = of_parse_phandle(node, "arm,vexpress,config-bridge", 0); bridge_np is only compared against pdev->dev.parent->of_node and is never released - neither on the "continue" path when it does not match, nor on the path that calls of_platform_populate() and falls through to the next loop iteration. Each matching iteration leaks one device_node reference; the leak repeats on every probe (driver bind/unbind, module reload, or EPROBE_DEFER retry). This is a regression of commit 557e37c05f28 ("bus: vexpress-config: add missing of_node_put after calling of_parse_phandle"), which fixed the equivalent leak in the predecessor function vexpress_config_populate(). Commit a5a38765ac79 ("bus: vexpress-config: simplify config bus probing") removed that function and inlined the loop into the probe routine, but did not carry over the of_node_put(). Use the __free(device_node) cleanup attribute on bridge_np so the reference is released automatically at the end of each loop iteration. Found by static analysis tool CodeQL. Fixes: a5a38765ac79 ("bus: vexpress-config: simplify config bus probing") Signed-off-by: Weigang He --- drivers/bus/vexpress-config.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/bus/vexpress-config.c b/drivers/bus/vexpress-config.c index 64ee920721ee7..cc247483d3823 100644 --- a/drivers/bus/vexpress-config.c +++ b/drivers/bus/vexpress-config.c @@ -390,9 +390,9 @@ static int vexpress_syscfg_probe(struct platform_device *pdev) } for_each_compatible_node(node, NULL, "arm,vexpress,config-bus") { - struct device_node *bridge_np; + struct device_node *bridge_np __free(device_node) = + of_parse_phandle(node, "arm,vexpress,config-bridge", 0); - bridge_np = of_parse_phandle(node, "arm,vexpress,config-bridge", 0); if (bridge_np != pdev->dev.parent->of_node) continue; base-commit: 0f61b1860cc3f52aef9036d7235ed1f017632193 -- 2.43.0