github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ARM: vexpress: fix device_node refcount leak in vexpress_smp_dt_prepare_cpus()

Browse Source 
vexpress_smp_dt_prepare_cpus() obtains a reference to the SCU device
node via of_find_matching_node() and passes it to of_iomap(), but never
calls of_node_put() on it. of_iomap() does not take ownership of the
node, so the reference is leaked. The function is the .smp_prepare_cpus
hook invoked once from the __init SMP bring-up path, so this is a
one-shot leak of a single refcount during boot, with no functional
impact.

Annotate scu with the __free(device_node) cleanup attribute so the
reference is released when the function returns.

Found while reviewing a CodeQL report for vexpress_flags_set() on the
same SMP bring-up path.

Fixes: d2606f81d5 ("ARM: vexpress: Simplify SMP operations for DT-powered system")
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20260925173252.933705-3-geoffreyhe2@gmail.com
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
This commit is contained in:
Weigang He 2026-09-26 03:32:52 +10:00 committed by Sudeep Holla
parent 62b9ae8ae4
commit 27b98d331f
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
arch/arm/mach-versatile/platsmp-vexpress.c
View File

@ -61,8 +61,8 @@ static const struct of_device_id vexpress_smp_dt_scu_match[] __initconst = {
static void __init vexpress_smp_dt_prepare_cpus(unsigned int max_cpus)
{
struct device_node *scu = of_find_matching_node(NULL,
vexpress_smp_dt_scu_match);
struct device_node *scu __free(device_node) =
of_find_matching_node(NULL, vexpress_smp_dt_scu_match);
if (scu)
scu_enable(of_iomap(scu, 0));