[PATCH 5/6] driver core: cpu: Fix OF node reference leak in register_cpu() error path

[PATCH 5/6] driver core: cpu: Fix OF node reference leak in register_cpu() error path

[Wentao Liang]

register_cpu() assigns the device node returned by of_get_cpu_node(),
which comes with a reference, to cpu->dev.of_node.  If device_register()
fails, the error path calls put_device() and returns, but nothing ever
drops the OF node reference: cpu_device_release() is empty and the
driver core does not put dev->of_node on the failure path, so each
failed registration leaks a reference on the device node.

Release the OF node with of_node_put() on the error path.  It is safe
to access cpu->dev.of_node after put_device(), since the statically
allocated struct cpu is never freed by cpu_device_release().

Fixes: f86e4718f24b ("driver/core: cpu: initialize of_node in cpu's device struture")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/base/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
index 875abdc9942e..bc96725c8d4c 100644
--- a/drivers/base/cpu.c
+++ b/drivers/base/cpu.c
@@ -431,6 +431,7 @@ int register_cpu(struct cpu *cpu, int num)
 	error = device_register(&cpu->dev);
 	if (error) {
 		put_device(&cpu->dev);
+		of_node_put(cpu->dev.of_node);
 		return error;
 	}
 
-- 
2.34.1

Re: [PATCH 5/6] driver core: cpu: Fix OF node reference leak in register_cpu() error path

[Sudeep Holla]

On Tue, Sep 15, 2026 at 04:35:23AM +0000, Wentao Liang wrote:
> register_cpu() assigns the device node returned by of_get_cpu_node(),
> which comes with a reference, to cpu->dev.of_node.  If device_register()
> fails, the error path calls put_device() and returns, but nothing ever
> drops the OF node reference: cpu_device_release() is empty and the
> driver core does not put dev->of_node on the failure path, so each
> failed registration leaks a reference on the device node.
> 
> Release the OF node with of_node_put() on the error path.  It is safe
> to access cpu->dev.of_node after put_device(), since the statically
> allocated struct cpu is never freed by cpu_device_release().
> 

If this is part of a series, I can't find 5 other patches or the cover
letter anywhere.

> Fixes: f86e4718f24b ("driver/core: cpu: initialize of_node in cpu's device struture")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/base/cpu.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
> index 875abdc9942e..bc96725c8d4c 100644
> --- a/drivers/base/cpu.c
> +++ b/drivers/base/cpu.c
> @@ -431,6 +431,7 @@ int register_cpu(struct cpu *cpu, int num)
>  	error = device_register(&cpu->dev);
>  	if (error) {
>  		put_device(&cpu->dev);
> +		of_node_put(cpu->dev.of_node);

I would also set the of_node to NULL as I see some archs like PPC is
making some decisions based on non-NULL pointer. I want to prevent any
further OF reference operations on that pointer.

-- 
Regards,
Sudeep

[PATCH v2] driver core: cpu: Fix OF node reference leak in register_cpu() error path

[Wentao Liang]

register_cpu() stores the reference from of_get_cpu_node() in
cpu->dev.of_node, but does not release it if device_register() fails.

Drop the reference on failure and clear the pointer, since architecture
code such as PPC's register_cpu_online() checks it for NULL before
obtaining a node reference.

Fixes: f86e4718f24b ("driver/core: cpu: initialize of_node in cpu's device struture")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
- Clear cpu->dev.of_node after of_node_put(), as Sudeep requested.
- Drop the series numbering. This is an independent fix and does not
  belong to a series with the other patches posted alongside it.
  That is a submission mistake on my side. Sorry for the delayed reply,
  the submission error, and the extra review work this caused.

 drivers/base/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
index 875abdc9942e..b50ba6a32a3a 100644
--- a/drivers/base/cpu.c
+++ b/drivers/base/cpu.c
@@ -431,6 +431,8 @@ int register_cpu(struct cpu *cpu, int num)
 	error = device_register(&cpu->dev);
 	if (error) {
 		put_device(&cpu->dev);
+		of_node_put(cpu->dev.of_node);
+		cpu->dev.of_node = NULL;
 		return error;
 	}
 
-- 
2.34.1