Re: [PATCH v2] PCI: rcar-gen4: Fix device_node leak in rcar_gen4_pcie_host_msi_addr()

[Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>]

On Wed, 23 Sep 2026 19:07:49 +0100
Fuad Tabba <fuad.tabba@linux.dev> wrote:

> rcar_gen4_pcie_host_msi_addr() calls of_msi_xlate() with *msi_np NULL,
> so it receives the MSI controller node with a reference held, and every
> return past the NULL check leaks that reference, the success path
> included. Declare msi_node with __free(device_node) so it's put on
> every return.
> 
> Fixes: 8d6af27c0a73 ("PCI: rcar-gen4: Configure AXIINTC if iMSI-RX is not used")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/linux-pci/20260905213855.8D6671F00A3D@smtp.kernel.org/
> Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org> # Retronix R-Car V4H Sparrow Hawk
> Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>

> ---
> 
> Notes:
>     Changes since v1:
>     - Declare msi_node immediately before of_msi_xlate() rather than at the
>       top of the function, as Jonathan asked on the iproc conversion [1].
>     - Kept Marek's Tested-by and Reviewed-by, since the generated code
>       differs only in the stack offsets of msi_node and res.
>     
>     [1] https://lore.kernel.org/all/20260923093433.00006cab@oss.qualcomm.com/
> 
>  drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
> index fbe465a29068f..bb2fcfd6861ac 100644
> --- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
> +++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
> @@ -323,7 +323,6 @@ static struct rcar_gen4_pcie *rcar_gen4_pcie_alloc(struct platform_device *pdev)
>  static int rcar_gen4_pcie_host_msi_addr(struct dw_pcie_rp *pp, u32 *msi_addr)
>  {
>  	struct dw_pcie *dw = to_dw_pcie_from_pp(pp);
> -	struct device_node *msi_node = NULL;
>  	struct device *dev = dw->dev;
>  	struct resource res;
>  	u64 addr;
> @@ -333,6 +332,7 @@ static int rcar_gen4_pcie_host_msi_addr(struct dw_pcie_rp *pp, u32 *msi_addr)
>  	 * Either the "msi-parent" or the "msi-map" phandle needs to exist
>  	 * to obtain the MSI node.
>  	 */
> +	struct device_node *msi_node __free(device_node) = NULL;
>  	of_msi_xlate(dev, &msi_node, 0);
>  	if (!msi_node)
>  		return -ENODEV;
> 
> base-commit: fd73f4a6659897191fa0d40695fe370925dd3780