of_irq_parse_one() raises the refcount of the interrupt controller node
on success, and of_irq_get_affinity() returns without putting it, so
every call past the parse leaks one reference. It is reached from
platform_get_irq_affinity(), used by arm_pmu, arm_spe_pmu and
coresight-trbe.

Put it once irq_populate_fwspec_info() has run: no in-tree
->get_fwspec_info() returns a mask that lives in the node.

Fixes: 5404f5c06dd4 ("of/irq: Add interrupt affinity reporting interface")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
 drivers/of/irq.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 967c191008797..ec035367c9500 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -563,7 +563,9 @@ const struct cpumask *of_irq_get_affinity(struct device_node *dev, int index)
 	of_phandle_args_to_fwspec(oirq.np, oirq.args, oirq.args_count,
 				  &fwspec);
 
-	if (irq_populate_fwspec_info(&fwspec, &info))
+	rc = irq_populate_fwspec_info(&fwspec, &info);
+	of_node_put(oirq.np);
+	if (rc)
 		return NULL;
 
 	return info.affinity;

base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
-- 
2.39.5

On Wed, 26 Aug 2026 12:22:34 +0100, Fuad Tabba wrote:
> of_irq_parse_one() raises the refcount of the interrupt controller node
> on success, and of_irq_get_affinity() returns without putting it, so
> every call past the parse leaks one reference. It is reached from
> platform_get_irq_affinity(), used by arm_pmu, arm_spe_pmu and
> coresight-trbe.
> 
> Put it once irq_populate_fwspec_info() has run: no in-tree
> ->get_fwspec_info() returns a mask that lives in the node.
> 
> Fixes: 5404f5c06dd4 ("of/irq: Add interrupt affinity reporting interface")
> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
> ---
>  drivers/of/irq.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 

Applied, thanks!