From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC16F278161 for ; Wed, 10 Jun 2026 05:31:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781069486; cv=none; b=XyZWmRuoQqr28ezWc99yjzBH3orVrSJa9uMLhj6w7DGz5SXLBEgRNrOFvs1dch0449fLg/bhpv4DHUyQuOu3dDEJw//Uq234DvfIKzbIGmIj1bVeWIcFfcwZWV6Od8qIuGYgxEDuMSTkSoM3XIpRE9hWx1oNkGP7XzFbsQpjtno= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781069486; c=relaxed/simple; bh=xncJOWmuYUFhSJpC2ndwx4Ilw8Yx+jekAMRqVnwcHuU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=KuEhiloaQ9w1wcem/P18JGRjzU3RrxHinelwRf6fcWCEp0Ei79rgvUK89DddBG2c3v4azvwZ5HnwHUqwmatP4ROKQspBgZObiNekOfA+Dk9du20Mdpnf5VWIWphMp/RyQ+tRK7rDuhMd3GbO3OhltPxS69RoO8oZ8BVsJqNpQ34= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qR9DOPh2; arc=none smtp.client-ip=209.85.214.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qR9DOPh2" Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2c27fc587ebso13281795ad.0 for ; Tue, 09 Jun 2026 22:31:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781069485; x=1781674285; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=yQdOheEUqRpM4ZgP7ld+n/Ny0a30r9dAAihdKcjT1Qk=; b=qR9DOPh2GRHTQadU3zPqG0SQWoapmA6T3xNlp9TLmx8Bohpe9AIYb6vR5iDRGmX3Wq AQtP1bYbisyjlbquLZQe4v1ETLXaEc2ZAkH6h+dErLiulslbivEXZ/6p6kcJT4jUxMqL e+Sgu+JtymSUiEGm4j2j57Cb6+meJxsqWVSyUp4I5kEzh0a7BiYcYYf84uowjMp1iW15 KbeyUnJMoIqU5dP1v65cvdZuKBiOLGgAnlWtk3JoqfvbCl02sxUTvj1MY3GVUvrTXi+s Y0LXEGK1q46FlSAnWSVE3Zm6GdDCI6wvjtWJNcX2UNo2v/o8r7eMfqMdWodbJMfTbZXc nehA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781069485; x=1781674285; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=yQdOheEUqRpM4ZgP7ld+n/Ny0a30r9dAAihdKcjT1Qk=; b=FjAQEZYaHJc5YpRO3UrDZVLcyrhaTig4rOQGHkR9UxARKfXO1gnnYc355PkLF0s6FR 9Wpq/9v8R4F+Elu90gmA4MQQay+JKDulnrCP21tK7jXvr+wayJgGdPg5Lavu8wGf0+uO /yzpenTvsGH9PQSiuk/tDuLkF/Ltm/hk/bPhPfoUsDs/jDkhK5Wr2MEveW6WQkRavER0 DN62S2ymf5ydi186A9inRN2M0+DQ4sTbA9hrvrcrMvXA8ZLmWSW1Ijj7VWX/W1y3nWMj OZMp6+/PG1xqyCChqgong/YG2LxKMDfmrQFd/HEF95+zdwUKngO44e7xgnmyoIjfC9do typg== X-Forwarded-Encrypted: i=1; AFNElJ+Ot8Fx3ZFLku5G4cfszN+oWNMumKWQJp4sX/kwxJE+qb920AGLv/B6FMaMjA6d/AMNT9G0R9S3kMglT0w=@vger.kernel.org X-Gm-Message-State: AOJu0YybhwtlYNjKuJqIvMH9mHBAqAtcUcy+gYiNmnPHGGRXK8iWIRg1 CMpJN1G3lWBfDoaAAAsIoxMQub2XdYe0sXHS4Yh9WwaQ/mBDk2deXC6m X-Gm-Gg: Acq92OHMkkL20GHoccDlBDJEIqxDqtHS734Vbh2TxLNLXa4gvr9TVX0W9qMzz2kF3Bo g2LjzSQJf8gtPFYnfrJcLykVNX/VsZ03e19pS6m1Dzie4MfMrcUGBeko4m7PSOyOwqC8sXAH7OV Ts/hoJ9Zr6/HERsrMgBkgXibOVSyHVVZrKUNyamGVk3uC+yRTmVOX1on3Lmmzr1pBeI+wIk65o5 ApRhksJ9qRfcLY5prR6muG1uvM32BoOzkR6QRXCfcSpmpc1gTllw+3hrMiTzal+R9IaaLTRMbA7 Ye3IaR/onuFQ3Zv6uY1VwGzomTYjjG1Ev5Y2w3LJTUkmTqSbNzYjkKg7VJFY4u1n7XP9lr4JslX o4fNtK/N+W8hK4KcbULwfoM1ka1BHFL0wFFO0I7FXWPwMBp/rZmas1rHH0EH79uj8Rqbwq93DPj +ie8XOs2Ye9Ikud9J1fS08WwMKtunPhQU0x0waxVUKKYiB8k7s4E++d9OerrgYddW9Ock9pnRv+ WvVTWvmixvhHQXf1i3mfjI3BEo7609kuKanYc69TxjeA9f9JS/naQ== X-Received: by 2002:a17:903:13ce:b0:2c0:c0fa:1659 with SMTP id d9443c01a7336-2c1e8207360mr303183845ad.33.1781069484906; Tue, 09 Jun 2026 22:31:24 -0700 (PDT) Received: from localhost.localdomain (n49-176-80-106.mas22.nsw.optusnet.com.au. [49.176.80.106]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c24edc8acasm107916975ad.45.2026.06.09.22.31.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jun 2026 22:31:24 -0700 (PDT) From: Weigang He To: Shawn Guo Cc: Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , Martin Kaiser , imx@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Weigang He Subject: [PATCH] ARM: imx: avic: fix device_node refcount leaks in mxc_init_irq() Date: Wed, 10 Jun 2026 15:31:15 +1000 Message-ID: <20260610053115.2263570-1-geoffreyhe2@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit mxc_init_irq() obtains two device_node references via of_find_compatible_node() and never releases either one: - The "fsl,imx25-ccm" node (looked up to map the CCM low-power interrupt mask registers on i.MX25) is stored in np, used by of_iomap(), and then the same np variable is overwritten by the second of_find_compatible_node() call without an of_node_put(). On i.MX25 this leaks the node reference on every boot. - The "fsl,avic" node is passed via of_fwnode_handle(np) to irq_domain_create_legacy(), which takes its own reference on the fwnode through fwnode_handle_get(), so the caller's reference is not transferred. np is then leaked at function return. Both lookups predate the switch to irq_domain_create_*(); the missing puts have been there since the code was introduced. Drop each reference once the value derived from it is no longer needed: after of_iomap() has mapped the CCM registers, and after irq_domain_create_legacy() has taken its own fwnode reference. of_node_put() is NULL-safe, so platforms without these nodes are unaffected. Found by static analysis tool CodeQL. Fixes: 544496ab5cbd ("ARM: imx: move irq_domain_add_legacy call into avic driver") Fixes: 9b454d16e57d ("ARM: imx: avic: set low-power interrupt mask for imx25") Signed-off-by: Weigang He --- arch/arm/mach-imx/avic.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/mach-imx/avic.c b/arch/arm/mach-imx/avic.c index 3067c06b4b8eb..6873a50bbe2c0 100644 --- a/arch/arm/mach-imx/avic.c +++ b/arch/arm/mach-imx/avic.c @@ -173,6 +173,7 @@ static void __init mxc_init_irq(void __iomem *irqbase) np = of_find_compatible_node(NULL, NULL, "fsl,imx25-ccm"); mx25_ccm_base = of_iomap(np, 0); + of_node_put(np); if (mx25_ccm_base) { /* @@ -203,6 +204,7 @@ static void __init mxc_init_irq(void __iomem *irqbase) np = of_find_compatible_node(NULL, NULL, "fsl,avic"); domain = irq_domain_create_legacy(of_fwnode_handle(np), AVIC_NUM_IRQS, irq_base, 0, &irq_domain_simple_ops, NULL); + of_node_put(np); WARN_ON(!domain); for (i = 0; i < AVIC_NUM_IRQS / 32; i++, irq_base += 32) base-commit: 0f61b1860cc3f52aef9036d7235ed1f017632193 -- 2.43.0