[PATCH v2] irqchip/gic-v3-its: Drop ITS node reference on its_of_probe() errors

[PATCH v2] irqchip/gic-v3-its: Drop ITS node reference on its_of_probe() errors

[Yuho Choi]

its_of_probe() walks the ITS nodes with of_find_matching_node(), which
drops the reference on the previous node and returns the next one with
its reference count raised. The loops are balanced when they run to the
end, but the three error returns (a failed its_reset_one(), a failed
its_node_init() and a failed its_probe_one()) leave with the current
node still referenced.

Declare the iterator in each loop with __free(device_node), so that the
reference is dropped whichever way the loop is left.

Fixes: c733ebb7cb67 ("irqchip/gic-v3-its: Reset each ITS's BASERn register before probe")
Fixes: 9585a495ac93 ("irqchip/gic-v3-its: Split allocation from initialisation of its_node")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
v2:
- Use __free(device_node) on the loop iterators instead of adding
  of_node_put() to each error return (Marc).
- Rebased on v7.4-rc1.

v1: https://lore.kernel.org/r/20260923165447.619477-1-oss.patchbox@gmail.com

Compile-tested only (arm64 defconfig, W=1).

 drivers/irqchip/irq-gic-v3-its.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 282e4bafb084..7c5df91a317c 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -5572,7 +5572,6 @@ static void its_node_destroy(struct its_node *its)
 
 static int __init its_of_probe(struct device_node *node)
 {
-	struct device_node *np;
 	struct resource res;
 	int err;
 
@@ -5582,7 +5581,8 @@ static int __init its_of_probe(struct device_node *node)
 	 * reset, don't even try to go any further, as this could
 	 * result in something even worse.
 	 */
-	for (np = of_find_matching_node(node, its_device_id); np;
+	for (struct device_node *np __free(device_node) =
+	     of_find_matching_node(node, its_device_id); np;
 	     np = of_find_matching_node(np, its_device_id)) {
 		if (!of_device_is_available(np) ||
 		    !of_property_read_bool(np, "msi-controller") ||
@@ -5594,7 +5594,8 @@ static int __init its_of_probe(struct device_node *node)
 			return err;
 	}
 
-	for (np = of_find_matching_node(node, its_device_id); np;
+	for (struct device_node *np __free(device_node) =
+	     of_find_matching_node(node, its_device_id); np;
 	     np = of_find_matching_node(np, its_device_id)) {
 		struct its_node *its;
 

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0

Re: [PATCH v2] irqchip/gic-v3-its: Drop ITS node reference on its_of_probe() errors

[Marc Zyngier]

On Tue, 03 Nov 2026 20:18:10 +0000,
Yuho Choi <oss.patchbox@gmail.com> wrote:
> 
> its_of_probe() walks the ITS nodes with of_find_matching_node(), which
> drops the reference on the previous node and returns the next one with
> its reference count raised. The loops are balanced when they run to the
> end, but the three error returns (a failed its_reset_one(), a failed
> its_node_init() and a failed its_probe_one()) leave with the current
> node still referenced.
> 
> Declare the iterator in each loop with __free(device_node), so that the
> reference is dropped whichever way the loop is left.
> 
> Fixes: c733ebb7cb67 ("irqchip/gic-v3-its: Reset each ITS's BASERn register before probe")
> Fixes: 9585a495ac93 ("irqchip/gic-v3-its: Split allocation from initialisation of its_node")
> Suggested-by: Marc Zyngier <maz@kernel.org>
> Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
> ---
> v2:
> - Use __free(device_node) on the loop iterators instead of adding
>   of_node_put() to each error return (Marc).
> - Rebased on v7.4-rc1.
> 
> v1: https://lore.kernel.org/r/20260923165447.619477-1-oss.patchbox@gmail.com
> 
> Compile-tested only (arm64 defconfig, W=1).
> 
>  drivers/irqchip/irq-gic-v3-its.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> index 282e4bafb084..7c5df91a317c 100644
> --- a/drivers/irqchip/irq-gic-v3-its.c
> +++ b/drivers/irqchip/irq-gic-v3-its.c
> @@ -5572,7 +5572,6 @@ static void its_node_destroy(struct its_node *its)
>  
>  static int __init its_of_probe(struct device_node *node)
>  {
> -	struct device_node *np;
>  	struct resource res;
>  	int err;
>  
> @@ -5582,7 +5581,8 @@ static int __init its_of_probe(struct device_node *node)
>  	 * reset, don't even try to go any further, as this could
>  	 * result in something even worse.
>  	 */
> -	for (np = of_find_matching_node(node, its_device_id); np;
> +	for (struct device_node *np __free(device_node) =
> +	     of_find_matching_node(node, its_device_id); np;

nit: please don't split assignments. Long lines are perfectly fine.

>  	     np = of_find_matching_node(np, its_device_id)) {
>  		if (!of_device_is_available(np) ||
>  		    !of_property_read_bool(np, "msi-controller") ||
> @@ -5594,7 +5594,8 @@ static int __init its_of_probe(struct device_node *node)
>  			return err;
>  	}
>  
> -	for (np = of_find_matching_node(node, its_device_id); np;
> +	for (struct device_node *np __free(device_node) =
> +	     of_find_matching_node(node, its_device_id); np;
>  	     np = of_find_matching_node(np, its_device_id)) {
>  		struct its_node *its;
>  

With that addressed:

Acked-by: Marc Zyngier <maz@kernel.org>

	M.

-- 
Without deviation from the norm, progress is not possible.