[PATCH 0/2] ARM: vexpress: fix two device_node refcount leaks

[PATCH 0/2] ARM: vexpress: fix two device_node refcount leaks

[Weigang He]

The Versatile Express SMP bring-up path leaks two device_node references
during boot:

  - vexpress_flags_set() (mach-versatile/v2m.c) leaks the
    "arm,vexpress-sysreg" node obtained via of_find_compatible_node().
  - vexpress_smp_dt_prepare_cpus() (mach-versatile/platsmp-vexpress.c)
    leaks the SCU node obtained via of_find_matching_node().

of_iomap() does not take ownership of the node, so each is a one-shot
refcount leak with no functional impact. They were introduced by
different commits, so they are split into one patch each.

The first leak was reported by static analysis (CodeQL); the second was
found while reviewing that report. The CodeQL query was synthesized
with LLM assistance, and the patches were drafted with LLM assistance;
I have reviewed them.

Compile-tested only (ARCH=arm multi_v7_defconfig, W=1); I have no
Versatile Express hardware.

Weigang He (2):
  ARM: vexpress: fix device_node refcount leak in vexpress_flags_set()
  ARM: vexpress: fix device_node refcount leak in
    vexpress_smp_dt_prepare_cpus()

 arch/arm/mach-versatile/platsmp-vexpress.c | 4 ++--
 arch/arm/mach-versatile/v2m.c              | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)


base-commit: 165768bb70265b5c38cf0b73fafd75be235f8b14
-- 
2.43.0

[PATCH 1/2] ARM: vexpress: fix device_node refcount leak in vexpress_flags_set()

[Weigang He]

vexpress_flags_set() obtains a reference to the "arm,vexpress-sysreg"
device node via of_find_compatible_node() and passes it to of_iomap(),
but never calls of_node_put() on it. of_iomap() only reads the node's
reg property to create the mapping and does not take ownership, so the
node reference is leaked. The function runs from the __init SMP prepare
path and caches the mapping in a static, so this is a one-shot leak of a
single refcount during boot, with no functional impact.

The lookup was added to drivers/mfd/vexpress-sysreg.c by the commit
below and later moved here by commit 9b06fc39084e ("ARM: vexpress: Move
vexpress_flags_set() into arch code").

Annotate node with the __free(device_node) cleanup attribute so the
reference is released when it goes out of scope.

Found by static analysis tool CodeQL.

Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
---

Notes:
    Compile-tested only (ARCH=arm multi_v7_defconfig, W=1). Not tested on
    hardware; I have no Versatile Express board.
    
    The CodeQL query behind this report was synthesized with LLM assistance,
    and the fix and changelog were drafted with LLM assistance; I have
    reviewed them.

 arch/arm/mach-versatile/v2m.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-versatile/v2m.c b/arch/arm/mach-versatile/v2m.c
index 79afdf2a90b6f..c86b38386cf7c 100644
--- a/arch/arm/mach-versatile/v2m.c
+++ b/arch/arm/mach-versatile/v2m.c
@@ -13,8 +13,8 @@ void vexpress_flags_set(u32 data)
 	static void __iomem *base;
 
 	if (!base) {
-		struct device_node *node = of_find_compatible_node(NULL, NULL,
-				"arm,vexpress-sysreg");
+		struct device_node *node __free(device_node) =
+			of_find_compatible_node(NULL, NULL, "arm,vexpress-sysreg");
 
 		base = of_iomap(node, 0);
 	}
-- 
2.43.0

Re: [PATCH 1/2] ARM: vexpress: fix device_node refcount leak in vexpress_flags_set()

[Liviu Dudau]

On Sat, Sep 26, 2026 at 03:32:51AM +1000, Weigang He wrote:
> vexpress_flags_set() obtains a reference to the "arm,vexpress-sysreg"
> device node via of_find_compatible_node() and passes it to of_iomap(),
> but never calls of_node_put() on it. of_iomap() only reads the node's
> reg property to create the mapping and does not take ownership, so the
> node reference is leaked. The function runs from the __init SMP prepare
> path and caches the mapping in a static, so this is a one-shot leak of a
> single refcount during boot, with no functional impact.
> 
> The lookup was added to drivers/mfd/vexpress-sysreg.c by the commit
> below and later moved here by commit 9b06fc39084e ("ARM: vexpress: Move
> vexpress_flags_set() into arch code").
> 
> Annotate node with the __free(device_node) cleanup attribute so the
> reference is released when it goes out of scope.
> 
> Found by static analysis tool CodeQL.
> 
> Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
> Assisted-by: LLM codeql
> Signed-off-by: Weigang He <geoffreyhe2@gmail.com>

Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>

Best regards,
Liviu

> ---
> 
> Notes:
>     Compile-tested only (ARCH=arm multi_v7_defconfig, W=1). Not tested on
>     hardware; I have no Versatile Express board.
>     
>     The CodeQL query behind this report was synthesized with LLM assistance,
>     and the fix and changelog were drafted with LLM assistance; I have
>     reviewed them.
> 
>  arch/arm/mach-versatile/v2m.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm/mach-versatile/v2m.c b/arch/arm/mach-versatile/v2m.c
> index 79afdf2a90b6f..c86b38386cf7c 100644
> --- a/arch/arm/mach-versatile/v2m.c
> +++ b/arch/arm/mach-versatile/v2m.c
> @@ -13,8 +13,8 @@ void vexpress_flags_set(u32 data)
>  	static void __iomem *base;
>  
>  	if (!base) {
> -		struct device_node *node = of_find_compatible_node(NULL, NULL,
> -				"arm,vexpress-sysreg");
> +		struct device_node *node __free(device_node) =
> +			of_find_compatible_node(NULL, NULL, "arm,vexpress-sysreg");
>  
>  		base = of_iomap(node, 0);
>  	}
> -- 
> 2.43.0
> 

-- 
====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯

[PATCH 2/2] ARM: vexpress: fix device_node refcount leak in vexpress_smp_dt_prepare_cpus()

[Weigang He]

vexpress_smp_dt_prepare_cpus() obtains a reference to the SCU device
node via of_find_matching_node() and passes it to of_iomap(), but never
calls of_node_put() on it. of_iomap() does not take ownership of the
node, so the reference is leaked. The function is the .smp_prepare_cpus
hook invoked once from the __init SMP bring-up path, so this is a
one-shot leak of a single refcount during boot, with no functional
impact.

Annotate scu with the __free(device_node) cleanup attribute so the
reference is released when the function returns.

Found while reviewing a CodeQL report for vexpress_flags_set() on the
same SMP bring-up path.

Fixes: d2606f81d563 ("ARM: vexpress: Simplify SMP operations for DT-powered system")
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
---

Notes:
    Compile-tested only (ARCH=arm multi_v7_defconfig, W=1). Not tested on
    hardware; I have no Versatile Express board.
    
    The CodeQL query behind this report was synthesized with LLM assistance,
    and the fix and changelog were drafted with LLM assistance; I have
    reviewed them.

 arch/arm/mach-versatile/platsmp-vexpress.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-versatile/platsmp-vexpress.c b/arch/arm/mach-versatile/platsmp-vexpress.c
index 1ee3c45e71c99..b810ad50b98ce 100644
--- a/arch/arm/mach-versatile/platsmp-vexpress.c
+++ b/arch/arm/mach-versatile/platsmp-vexpress.c
@@ -61,8 +61,8 @@ static const struct of_device_id vexpress_smp_dt_scu_match[] __initconst = {
 
 static void __init vexpress_smp_dt_prepare_cpus(unsigned int max_cpus)
 {
-	struct device_node *scu = of_find_matching_node(NULL,
-			vexpress_smp_dt_scu_match);
+	struct device_node *scu __free(device_node) =
+		of_find_matching_node(NULL, vexpress_smp_dt_scu_match);
 
 	if (scu)
 		scu_enable(of_iomap(scu, 0));
-- 
2.43.0

Re: [PATCH 2/2] ARM: vexpress: fix device_node refcount leak in vexpress_smp_dt_prepare_cpus()

[Liviu Dudau]

On Sat, Sep 26, 2026 at 03:32:52AM +1000, Weigang He wrote:
> vexpress_smp_dt_prepare_cpus() obtains a reference to the SCU device
> node via of_find_matching_node() and passes it to of_iomap(), but never
> calls of_node_put() on it. of_iomap() does not take ownership of the
> node, so the reference is leaked. The function is the .smp_prepare_cpus
> hook invoked once from the __init SMP bring-up path, so this is a
> one-shot leak of a single refcount during boot, with no functional
> impact.
> 
> Annotate scu with the __free(device_node) cleanup attribute so the
> reference is released when the function returns.
> 
> Found while reviewing a CodeQL report for vexpress_flags_set() on the
> same SMP bring-up path.
> 
> Fixes: d2606f81d563 ("ARM: vexpress: Simplify SMP operations for DT-powered system")
> Assisted-by: LLM codeql
> Signed-off-by: Weigang He <geoffreyhe2@gmail.com>

Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>

Best regards,
Liviu

> ---
> 
> Notes:
>     Compile-tested only (ARCH=arm multi_v7_defconfig, W=1). Not tested on
>     hardware; I have no Versatile Express board.
>     
>     The CodeQL query behind this report was synthesized with LLM assistance,
>     and the fix and changelog were drafted with LLM assistance; I have
>     reviewed them.
> 
>  arch/arm/mach-versatile/platsmp-vexpress.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm/mach-versatile/platsmp-vexpress.c b/arch/arm/mach-versatile/platsmp-vexpress.c
> index 1ee3c45e71c99..b810ad50b98ce 100644
> --- a/arch/arm/mach-versatile/platsmp-vexpress.c
> +++ b/arch/arm/mach-versatile/platsmp-vexpress.c
> @@ -61,8 +61,8 @@ static const struct of_device_id vexpress_smp_dt_scu_match[] __initconst = {
>  
>  static void __init vexpress_smp_dt_prepare_cpus(unsigned int max_cpus)
>  {
> -	struct device_node *scu = of_find_matching_node(NULL,
> -			vexpress_smp_dt_scu_match);
> +	struct device_node *scu __free(device_node) =
> +		of_find_matching_node(NULL, vexpress_smp_dt_scu_match);
>  
>  	if (scu)
>  		scu_enable(of_iomap(scu, 0));
> -- 
> 2.43.0
> 

-- 
====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯