From nobody Wed Oct 8 23:09:10 2025 Received: from outbound.pv.icloud.com (p-west1-cluster4-host9-snip4-10.eps.apple.com [57.103.65.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B38A0253B60 for ; Mon, 23 Jun 2025 13:18:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=57.103.65.161 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750684704; cv=none; b=sPg3FbHZTZuvXUApUBTeAuVCJgoKkikt/1l04qaMphLhLeh3/As8b9/Onbvl7Gb8aM5qoyPXTRyQeFsNl22u+OmMUAiTDKH+NUT+2oS0c9/4m0JrYBtWXuXENPmjuy+C+DuUfOP6l54Myg1dBobNnjoeDWpbZZuqWEFkeYXlJFA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750684704; c=relaxed/simple; bh=sYTdZMwWF90XapDPNA3is4Bwp4J9gIgqdGqN0eKZaBk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=AvbN7MTVN6tgHwUA+G5q6EYs74zTOdv1dZXiRJ4GbkML1fU6YoUcFan8nwM9bu0pjbChhXGQbvdNFELdDhE4OoITy8ozQ6n3sFnyNQpetICDEV7HSDqbc6k2UEMZy04LLy4+i0ijvUr4cjohXde5MOzPI0Dat0aONs5AYhb3S5g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=w2RcrWWT; arc=none smtp.client-ip=57.103.65.161 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="w2RcrWWT" Received: from outbound.pv.icloud.com (unknown [127.0.0.2]) by outbound.pv.icloud.com (Postfix) with ESMTPS id 5ABB418004C7; Mon, 23 Jun 2025 13:18:19 +0000 (UTC) Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; bh=OMbHKj8ufINmQzvBMRMgluViwzlNQzc54nokzS3b81s=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:x-icloud-hme; b=w2RcrWWTQ9pvCVagNE/QgnUEXOC3jExLaV/UPkVolEoLH0SDeh0KemU8iH2yg50tFW2Dfz5BKk3qcaDC1TeIhm+4UXl7mLZlWnmGx5MKx9on7EqzuHPf5Ncy5I8scnD9eN5CC1bKOpcSpthrsf+7jivgtzwkHUG/EOgsbCkkWDCy08ra6/ri0xfV2JBRPWYQaHQNiQ2rEKMYWlSDmENKoKwhiYPam/cdqnsvBAPSp4pWCBYJAZ8vqmVor/9XIot+4nI8OeYnb6uW68gm0BS/0kAR/3FJqkFQhI2wsox9TcU8ZmeDVvnM1mbtsCPpo38AMq+erOuoElKj2XH2P3OWcQ== Received: from [192.168.1.26] (pv-asmtp-me-k8s.p00.prod.me.com [17.56.9.36]) by outbound.pv.icloud.com (Postfix) with ESMTPSA id 8239F1800262; Mon, 23 Jun 2025 13:18:16 +0000 (UTC) From: Zijun Hu Date: Mon, 23 Jun 2025 21:17:38 +0800 Subject: [PATCH v2 1/2] PCI: of: Fix OF device node refcount leakage in API of_irq_parse_and_map_pci() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250623-fix_of_pci-v2-1-5bbb65190d47@oss.qualcomm.com> References: <20250623-fix_of_pci-v2-0-5bbb65190d47@oss.qualcomm.com> In-Reply-To: <20250623-fix_of_pci-v2-0-5bbb65190d47@oss.qualcomm.com> To: Bjorn Helgaas , Rob Herring , Lizhi Hou Cc: Greg Kroah-Hartman , Zijun Hu , linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu , Zijun Hu X-Mailer: b4 0.14.2 X-Proofpoint-ORIG-GUID: 2U4nMRVy2HnglEpCHjNt-Xp9W2kywZ8d X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNjIzMDA4MCBTYWx0ZWRfX6fdgROnvHIXM coTd0/Peakp/CPaoYfduTCANyXV34TnUbsP+jYXjXFiWfgTPVLP1W/ahd+ur56JAGjDhQi4XrRJ i1tZke32pO5jLOCgDr/nW5owGmjbMzb2TwLH/uAywhMiD5vTKRfSJQjtMpkzNJ0k5fFR3YnYK0Y 0hcYA1vEbILKu45ZVV/b7hS0HO9OKyLM1akceFBXEkbtzb8I+0maPY/6NkJ0jr9y6IzHiaS0P+f P61Qk+odg5eMb7J34tc2CYMNU2B3vPS4Ytd77iMjIV8O3YXXm1seGqF2+QVhqVtshE5pDb8Io= X-Proofpoint-GUID: 2U4nMRVy2HnglEpCHjNt-Xp9W2kywZ8d X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-06-23_03,2025-06-23_03,2025-03-28_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 mlxscore=0 malwarescore=0 spamscore=0 mlxlogscore=999 bulkscore=0 suspectscore=0 clxscore=1015 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.22.0-2506060001 definitions=main-2506230080 From: Zijun Hu Successful of_irq_parse_pci() invocation will increase refcount of OF device node @oirq.np, but API of_irq_parse_and_map_pci() does not decrease the refcount before return, so cause @oirq.np refcount leakage. Fix by using OF __free() to decrease the refcount. Signed-off-by: Zijun Hu Cc: Rob Herring (Arm) --- drivers/pci/of.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/pci/of.c b/drivers/pci/of.c index 3579265f119845637e163d9051437c89662762f8..fd6596b251246c3b64b2558c676= 52d01f142c785 100644 --- a/drivers/pci/of.c +++ b/drivers/pci/of.c @@ -576,6 +576,7 @@ static int of_irq_parse_pci(const struct pci_dev *pdev,= struct of_phandle_args * */ int of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin) { + struct device_node *np __free(device_node) =3D NULL; struct of_phandle_args oirq; int ret; =20 @@ -583,6 +584,7 @@ int of_irq_parse_and_map_pci(const struct pci_dev *dev,= u8 slot, u8 pin) if (ret) return 0; /* Proper return code 0 =3D=3D NO_IRQ */ =20 + np =3D oirq.np; return irq_create_of_mapping(&oirq); } EXPORT_SYMBOL_GPL(of_irq_parse_and_map_pci); --=20 2.34.1 From nobody Wed Oct 8 23:09:10 2025 Received: from outbound.pv.icloud.com (p-west1-cluster4-host6-snip4-10.eps.apple.com [57.103.65.251]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5EF1B254B03 for ; Mon, 23 Jun 2025 13:18:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=57.103.65.251 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750684706; cv=none; b=AlB9DWRLlBi26iXNlMnQy/BJWzZ+7tBYwkedhcl3Zl4QF5FSiw8h061iYjRRsLcJMqq5+VIIGCxSU3TBcbapXyHl4W/Ujuu374qvesMQLZ7tcxW9/vnSJrdNNiNI83A/V9LIlyBKiKdNJ4O28uZ0NjGUML+6m4SsO5gEOsbkWLc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750684706; c=relaxed/simple; bh=6uy0LFYrWg7xHF33/zV+z/ktLd3QRfymC2Ad3yoEg8w=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=EdHX8azH2dG9deB9Qnm4Cm6dYfcBw58erZF/h429URzeMwMJZaKfmztHgaV1oviPK8mbIH9QB43KOvwWVknKgTIHTimDcC4o6vzXWNxgBXsobiP0RXwQmLi9u6vz4Vr9rnDQ0jmafQQvmP9yGrwQLT1j+WoBaYro+O3qgxHxpxo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com; spf=pass smtp.mailfrom=icloud.com; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b=W0o6O/ey; arc=none smtp.client-ip=57.103.65.251 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=icloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=icloud.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=icloud.com header.i=@icloud.com header.b="W0o6O/ey" Received: from outbound.pv.icloud.com (unknown [127.0.0.2]) by outbound.pv.icloud.com (Postfix) with ESMTPS id 66EBA1800262; Mon, 23 Jun 2025 13:18:22 +0000 (UTC) Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; bh=kFGiyhJP9jhxrKXxczAwa5t3gkxlw1rtSDudPa7j8BY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:x-icloud-hme; b=W0o6O/eyil0flsQgBkQtR4Tj1efmrJj+DQ94v0LaWLeJxXLXGCLntRHkoR1EiwzYK36/FnLuxNABbqt7Zo+YSLs4MoV1EmSzKQe83cteP265sLg+c9RKoAwAW/+Ktw7no+C39aWJb4pfH6YYF2Ss6qBgdvT0OwXkjDREeD6THyVAKhSBr3/iL1oi93b8ZJRPOuHnbo17ulJLi10771drVvC71qrfBI1nGw1ee/sYUtF73LV61Ah4SQObKSJ2DXU1aLV+eUqV9JPSNrbxCj5rnrU/uGcFqITiGBvevoQ4l5fjNI35OeIxGi32y+FuleyfTpPusEXZbeOeMc83ezbGpQ== Received: from [192.168.1.26] (pv-asmtp-me-k8s.p00.prod.me.com [17.56.9.36]) by outbound.pv.icloud.com (Postfix) with ESMTPSA id E1D1418001FF; Mon, 23 Jun 2025 13:18:18 +0000 (UTC) From: Zijun Hu Date: Mon, 23 Jun 2025 21:17:39 +0800 Subject: [PATCH v2 2/2] PCI: of: Fix OF device node refcount leakages in of_pci_prop_intr_map() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250623-fix_of_pci-v2-2-5bbb65190d47@oss.qualcomm.com> References: <20250623-fix_of_pci-v2-0-5bbb65190d47@oss.qualcomm.com> In-Reply-To: <20250623-fix_of_pci-v2-0-5bbb65190d47@oss.qualcomm.com> To: Bjorn Helgaas , Rob Herring , Lizhi Hou Cc: Greg Kroah-Hartman , Zijun Hu , linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu , Zijun Hu , stable@vger.kernel.org X-Mailer: b4 0.14.2 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNjIzMDA4MCBTYWx0ZWRfX5IyL5d3hacHV JmvSNsdIJqbBln/AfO+vK5mmc9jPjy7xcfhgJj9uM8wsrTxgGd/j0OBXs7L7iKXXI6vFLAwwymB ibPaduNYnLtyzUuEfquOEAUIoqYXchEIbZF+hSwEUFHsEFrE1MeIOG7gjxPKUxUfbFIbdIj2qQg nfZ2yjADXoPpQJ1haLl+i0prQreinVKRug7olf9TzneQNV1ZKZrvGTlWQdOWL+CdRJkPEd5gzl5 Se+NLwMWXI22fg2EuWnU2LTMTXAPolVECbHmuKAadik0bux1BIXyvqEkL6uRWUGh5AZ+uarpQ= X-Proofpoint-GUID: 9hyoxXXMA-oA7DkAHi2A2t-wJ08qcvp3 X-Proofpoint-ORIG-GUID: 9hyoxXXMA-oA7DkAHi2A2t-wJ08qcvp3 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-06-23_03,2025-06-23_03,2025-03-28_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 clxscore=1015 adultscore=0 mlxscore=0 malwarescore=0 phishscore=0 bulkscore=0 mlxlogscore=999 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.22.0-2506060001 definitions=main-2506230080 From: Zijun Hu Successful of_irq_parse_raw() invocation will increase refcount of OF device node @out_irq[].np, but of_pci_prop_intr_map() does not decrease the refcount before return, so cause @out_irq[].np refcount leakages. Fix by putting @out_irq[].np refcount before return. Fixes: 407d1a51921e ("PCI: Create device tree node for bridge") Cc: Rob Herring (Arm) Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu --- drivers/pci/of_property.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c index 506fcd5071139e0c11130f4c36f5082ed9789efb..4250a78fafbec4c29af124d7ba5= ece7b0b785fb3 100644 --- a/drivers/pci/of_property.c +++ b/drivers/pci/of_property.c @@ -258,12 +258,16 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev,= struct of_changeset *ocs, * Parsing interrupt failed for all pins. In this case, it does not * need to generate interrupt-map property. */ - if (!map_sz) - return 0; + if (!map_sz) { + ret =3D 0; + goto out_put_nodes; + } =20 int_map =3D kcalloc(map_sz, sizeof(u32), GFP_KERNEL); - if (!int_map) - return -ENOMEM; + if (!int_map) { + ret =3D -ENOMEM; + goto out_put_nodes; + } mapp =3D int_map; =20 list_for_each_entry(child, &pdev->subordinate->devices, bus_list) { @@ -305,14 +309,12 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev,= struct of_changeset *ocs, ret =3D of_changeset_add_prop_u32_array(ocs, np, "interrupt-map-mask", int_map_mask, ARRAY_SIZE(int_map_mask)); - if (ret) - goto failed; - - kfree(int_map); - return 0; =20 failed: kfree(int_map); +out_put_nodes: + for (i =3D 0; i < OF_PCI_MAX_INT_PIN; i++) + of_node_put(out_irq[i].np); return ret; } =20 --=20 2.34.1