Re: [PATCH] bus: arm-cci: fix device_node refcount leak in cci_probe_ports()

Re: [PATCH] bus: arm-cci: fix device_node refcount leak in cci_probe_ports()

[Markus Elfring]

> cci_probe_ports() has two device_node refcount bugs in its
> for_each_available_child_of_node() loop over "cp":
…

How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?

See also:
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2-rc5#n145
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.2-rc5#n34

Regards,
Markus

Re: [PATCH] bus: arm-cci: fix device_node refcount leak in cci_probe_ports()

[Robin Murphy]

On 2026-08-24 8:00 am, Markus Elfring wrote:
>> cci_probe_ports() has two device_node refcount bugs in its
>> for_each_available_child_of_node() loop over "cp":
> …
> 
> How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?

No.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.2-rc5#n15

> 
> See also:
> * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2-rc5#n145
> * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.2-rc5#n34
> 
> Regards,
> Markus

Re: [PATCH] bus: arm-cci: fix device_node refcount leak in cci_probe_ports()

[Markus Elfring]

>>> cci_probe_ports() has two device_node refcount bugs in its
>>> for_each_available_child_of_node() loop over "cp":
>> …
>>
>> How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?
> 
> No.
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.2-rc5#n15
Have you got special imaginations for the bug severity?

Regards,
Markus

[PATCH] bus: arm-cci: fix device_node refcount leak in cci_probe_ports()

[Manush Prajwal]

When the number of matching child nodes reaches nb_cci_ports,
cci_probe_ports() breaks out of the for_each_available_child_of_node()
loop without releasing the reference held on the current node. Every
other exit from this loop iteration either continues (handled by the
iterator) or stores the node into ports[i].dn; this early break is the
only path that drops the last handle to the node without a matching
of_node_put(). Add it before the break.

Signed-off-by: Manush Prajwal <manushprajwal555@gmail.com>
---
 drivers/bus/arm-cci.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c
index 7f2baf0571..5ab3d74c9a 100644
--- a/drivers/bus/arm-cci.c
+++ b/drivers/bus/arm-cci.c
@@ -461,8 +461,10 @@ static int cci_probe_ports(struct device_node *np)
 
 		i = nb_ace + nb_ace_lite;
 
-		if (i >= nb_cci_ports)
+		if (i >= nb_cci_ports) {
+			of_node_put(cp);
 			break;
+		}
 
 		if (of_property_read_string(cp, "interface-type",
 					&match_str)) {
-- 
2.46.2.windows.1