In rzg3s_pcie_host_parse_port(), of_get_next_child() returns a device
node with an incremented reference count that must be released with
of_node_put(). The current code fails to call of_node_put() which
causes a reference leak.

Use the __free(device_node) attribute to ensure automatic cleanup when
the variable goes out of scope.

Fixes: 7ef502fb35b2 ("PCI: Add Renesas RZ/G3S host controller driver")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
---
 drivers/pci/controller/pcie-rzg3s-host.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pcie-rzg3s-host.c b/drivers/pci/controller/pcie-rzg3s-host.c
index 5aa58638903f..2809112e6317 100644
--- a/drivers/pci/controller/pcie-rzg3s-host.c
+++ b/drivers/pci/controller/pcie-rzg3s-host.c
@@ -1142,7 +1142,8 @@ static int rzg3s_pcie_resets_prepare_and_get(struct rzg3s_pcie_host *host)
 
 static int rzg3s_pcie_host_parse_port(struct rzg3s_pcie_host *host)
 {
-	struct device_node *of_port = of_get_next_child(host->dev->of_node, NULL);
+	struct device_node *of_port __free(device_node) =
+		of_get_next_child(host->dev->of_node, NULL);
 	struct rzg3s_pcie_port *port = &host->port;
 	int ret;
 

---
base-commit: 193579fe01389bc21aff0051d13f24e8ea95b47d
change-id: 20260204-rzg3s-bc7c27c80a89

Best regards,
-- 
Felix Gu <ustc.gu@gmail.com>

On Wed, Feb 04, 2026 at 12:46:24AM +0800, Felix Gu wrote:
> In rzg3s_pcie_host_parse_port(), of_get_next_child() returns a device
> node with an incremented reference count that must be released with
> of_node_put(). The current code fails to call of_node_put() which
> causes a reference leak.
> 
> Use the __free(device_node) attribute to ensure automatic cleanup when
> the variable goes out of scope.
> 
> Fixes: 7ef502fb35b2 ("PCI: Add Renesas RZ/G3S host controller driver")
> Signed-off-by: Felix Gu <ustc.gu@gmail.com>

Applied to pci/controller/rzg3s-host for v6.20, thanks!

It's close to the merge window, but only affects a single driver
that's pretty new, so if anything breaks it won't affect many people.

> ---
>  drivers/pci/controller/pcie-rzg3s-host.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/controller/pcie-rzg3s-host.c b/drivers/pci/controller/pcie-rzg3s-host.c
> index 5aa58638903f..2809112e6317 100644
> --- a/drivers/pci/controller/pcie-rzg3s-host.c
> +++ b/drivers/pci/controller/pcie-rzg3s-host.c
> @@ -1142,7 +1142,8 @@ static int rzg3s_pcie_resets_prepare_and_get(struct rzg3s_pcie_host *host)
>  
>  static int rzg3s_pcie_host_parse_port(struct rzg3s_pcie_host *host)
>  {
> -	struct device_node *of_port = of_get_next_child(host->dev->of_node, NULL);
> +	struct device_node *of_port __free(device_node) =
> +		of_get_next_child(host->dev->of_node, NULL);
>  	struct rzg3s_pcie_port *port = &host->port;
>  	int ret;
>  
> 
> ---
> base-commit: 193579fe01389bc21aff0051d13f24e8ea95b47d
> change-id: 20260204-rzg3s-bc7c27c80a89
> 
> Best regards,
> -- 
> Felix Gu <ustc.gu@gmail.com>
>

On Wed, Feb 04, 2026 at 12:46:24AM +0800, Felix Gu wrote:
> In rzg3s_pcie_host_parse_port(), of_get_next_child() returns a device
> node with an incremented reference count that must be released with
> of_node_put(). The current code fails to call of_node_put() which
> causes a reference leak.
> 
> Use the __free(device_node) attribute to ensure automatic cleanup when
> the variable goes out of scope.
> 
> Fixes: 7ef502fb35b2 ("PCI: Add Renesas RZ/G3S host controller driver")
> Signed-off-by: Felix Gu <ustc.gu@gmail.com>

Patch LGTM. But we are nearing the merge window. So I'm not sure if Bjorn would
be happy for me to merge any patches atm.

Since this fix is trivial, we can defer it for 7.1.

Bjorn, if you decide to merge this still, feel free to add:

Acked-by: Manivannan Sadhasivam <mani@kernel.org>

On a side note, I see that this driver just parses the first Root Port instead
of parsing all Root Port nodes because the current IP design has only one RP.
But for uniformity, it should parse all nodes so that if the IP gets extended
in the future, driver can still hoepfully work.

This further motivates me to come up with host controller generic APIs to parse
the Root Ports :)

- Mani

> ---
>  drivers/pci/controller/pcie-rzg3s-host.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/controller/pcie-rzg3s-host.c b/drivers/pci/controller/pcie-rzg3s-host.c
> index 5aa58638903f..2809112e6317 100644
> --- a/drivers/pci/controller/pcie-rzg3s-host.c
> +++ b/drivers/pci/controller/pcie-rzg3s-host.c
> @@ -1142,7 +1142,8 @@ static int rzg3s_pcie_resets_prepare_and_get(struct rzg3s_pcie_host *host)
>  
>  static int rzg3s_pcie_host_parse_port(struct rzg3s_pcie_host *host)
>  {
> -	struct device_node *of_port = of_get_next_child(host->dev->of_node, NULL);
> +	struct device_node *of_port __free(device_node) =
> +		of_get_next_child(host->dev->of_node, NULL);
>  	struct rzg3s_pcie_port *port = &host->port;
>  	int ret;
>  
> 
> ---
> base-commit: 193579fe01389bc21aff0051d13f24e8ea95b47d
> change-id: 20260204-rzg3s-bc7c27c80a89
> 
> Best regards,
> -- 
> Felix Gu <ustc.gu@gmail.com>
> 

-- 
மணிவண்ணன் சதாசிவம்

On 2/3/26 18:46, Felix Gu wrote:
> In rzg3s_pcie_host_parse_port(), of_get_next_child() returns a device
> node with an incremented reference count that must be released with
> of_node_put(). The current code fails to call of_node_put() which
> causes a reference leak.
> 
> Use the __free(device_node) attribute to ensure automatic cleanup when
> the variable goes out of scope.
> 
> Fixes: 7ef502fb35b2 ("PCI: Add Renesas RZ/G3S host controller driver")
> Signed-off-by: Felix Gu <ustc.gu@gmail.com>


Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>