socfpga_smp_prepare_cpus() looks up the Cortex-A9 SCU node with
of_find_compatible_node(), which returns a node reference that must be
released with of_node_put().

The function maps the SCU registers and then returns without dropping
that reference, leaking the node on both the success path and the
of_iomap() failure path.

Drop the reference once the mapping attempt is complete. The returned
MMIO mapping does not depend on keeping the device node reference held.

Fixes: 122694a0c712 ("ARM: socfpga: use of_iomap to map the SCU")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 arch/arm/mach-socfpga/platsmp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/mach-socfpga/platsmp.c b/arch/arm/mach-socfpga/platsmp.c
index 201191cf68f3..349e6c54518e 100644
--- a/arch/arm/mach-socfpga/platsmp.c
+++ b/arch/arm/mach-socfpga/platsmp.c
@@ -78,6 +78,7 @@ static void __init socfpga_smp_prepare_cpus(unsigned int max_cpus)
 	}
 
 	socfpga_scu_base_addr = of_iomap(np, 0);
+	of_node_put(np);
 	if (!socfpga_scu_base_addr)
 		return;
 	scu_enable(socfpga_scu_base_addr);
-- 
2.43.0

Hi Yuho,

On 5/24/26 21:47, Yuho Choi wrote:
> socfpga_smp_prepare_cpus() looks up the Cortex-A9 SCU node with
> of_find_compatible_node(), which returns a node reference that must be
> released with of_node_put().
> 
> The function maps the SCU registers and then returns without dropping
> that reference, leaking the node on both the success path and the
> of_iomap() failure path.
> 
> Drop the reference once the mapping attempt is complete. The returned
> MMIO mapping does not depend on keeping the device node reference held.
> 
> Fixes: 122694a0c712 ("ARM: socfpga: use of_iomap to map the SCU")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>

I'll add "Cc: stable@vger.kernel.org" here, but please remember to add 
this for future patches that have the Fixes tag.

Thanks,

Dinh