From nobody Thu Sep 24 13:37:32 2026 Received: from mta0.migadu.com (out-28.mta0.migadu.com [91.218.175.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A7F014279E0 for ; Wed, 23 Sep 2026 18:07:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.28 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790186875; cv=none; b=FGJmfCgn7FAxg2MRc7VGMdUVxWQCHSQ1/NKVbkEqXUsQx+te3HxHkTpZCwXo1Tc7qMF4DvSblTOnZef66PChL0QQpLBLOhWy299dzIjFZwyiWzE5e3pV69cWNzCJdajwlTgWgWtfY2lDDW4sEj+nqx7yMW2mCsrAz5ZtOfyJ0gY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790186875; c=relaxed/simple; bh=bp0SnK46xnvz/q8fX5PdkYUTIaH6Zd0obLz2gE4r2gY=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=fkYSRvMaLQNBbfZfl6tIovQvL0XY1iG5+/p+7Wv5hbpAp8w3cFpggmliR8452mUBJLQmLF2rd7CA9vOmnlOFypOFuFLZ7W96gVm9a+hVb1j/3Da50+GwaNZ+crVD478WYXylOyIfr7YCqGHOp394XU3uKGxUickbzo2cCX3DnlE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=u/W4NWyF; arc=none smtp.client-ip=91.218.175.28 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="u/W4NWyF" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=bp0SnK46xnvz/q8fX5PdkYUTIaH6Zd0obLz2gE4r2gY=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1790186871; v=1; x=1790791671; b=u/W4NWyFrBL56Tt/9bzBEJDx/7TbwWqM+UwBDAZ9JblZPdkea7FnD+Bbbu9fzbsRzFJA0niu rjx3ZudkE+FksUD85x9WNW6/N8lYJZz5f8nTRM0jel9Y6s6tGPw7LWNE8W6GBn74GCYTKHmRacm /xGnNBQIVjW9fzFj9KlOyOkI= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id a9800f2f57d37519; Wed, 23 Sep 2026 18:07:51 +0000 X-Mizu-Trace-ID: a9800f2f57d37519 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Manivannan Sadhasivam , Marek Vasut , Yoshihiro Shimoda Cc: Lorenzo Pieralisi , =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= , Rob Herring , Bjorn Helgaas , Geert Uytterhoeven , Magnus Damm , Jonathan Cameron , linux-pci@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Will Deacon , Fuad Tabba Subject: [PATCH v2] PCI: rcar-gen4: Fix device_node leak in rcar_gen4_pcie_host_msi_addr() Date: Wed, 23 Sep 2026 19:07:49 +0100 Message-Id: <20260923180749.3906547-1-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" rcar_gen4_pcie_host_msi_addr() calls of_msi_xlate() with *msi_np NULL, so it receives the MSI controller node with a reference held, and every return past the NULL check leaks that reference, the success path included. Declare msi_node with __free(device_node) so it's put on every return. Fixes: 8d6af27c0a73 ("PCI: rcar-gen4: Configure AXIINTC if iMSI-RX is not u= sed") Reported-by: Sashiko Closes: https://lore.kernel.org/linux-pci/20260905213855.8D6671F00A3D@smtp.= kernel.org/ Tested-by: Marek Vasut # Retronix R-Car V= 4H Sparrow Hawk Reviewed-by: Marek Vasut Signed-off-by: Fuad Tabba Reviewed-by: Jonathan Cameron --- Notes: Changes since v1: - Declare msi_node immediately before of_msi_xlate() rather than at the top of the function, as Jonathan asked on the iproc conversion [1]. - Kept Marek's Tested-by and Reviewed-by, since the generated code differs only in the stack offsets of msi_node and res. =20 [1] https://lore.kernel.org/all/20260923093433.00006cab@oss.qualcomm.co= m/ drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/cont= roller/dwc/pcie-rcar-gen4.c index fbe465a29068f..bb2fcfd6861ac 100644 --- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c +++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c @@ -323,7 +323,6 @@ static struct rcar_gen4_pcie *rcar_gen4_pcie_alloc(stru= ct platform_device *pdev) static int rcar_gen4_pcie_host_msi_addr(struct dw_pcie_rp *pp, u32 *msi_ad= dr) { struct dw_pcie *dw =3D to_dw_pcie_from_pp(pp); - struct device_node *msi_node =3D NULL; struct device *dev =3D dw->dev; struct resource res; u64 addr; @@ -333,6 +332,7 @@ static int rcar_gen4_pcie_host_msi_addr(struct dw_pcie_= rp *pp, u32 *msi_addr) * Either the "msi-parent" or the "msi-map" phandle needs to exist * to obtain the MSI node. */ + struct device_node *msi_node __free(device_node) =3D NULL; of_msi_xlate(dev, &msi_node, 0); if (!msi_node) return -ENODEV; base-commit: fd73f4a6659897191fa0d40695fe370925dd3780 --=20 2.39.5