From 27b98d331f1dcebe088ab51a7061a387a7440cb2 Mon Sep 17 00:00:00 2001 From: Weigang He Date: Sat, 26 Sep 2026 03:32:52 +1000 Subject: [PATCH] ARM: vexpress: fix device_node refcount leak in vexpress_smp_dt_prepare_cpus() vexpress_smp_dt_prepare_cpus() obtains a reference to the SCU device node via of_find_matching_node() and passes it to of_iomap(), but never calls of_node_put() on it. of_iomap() does not take ownership of the node, so the reference is leaked. The function is the .smp_prepare_cpus hook invoked once from the __init SMP bring-up path, so this is a one-shot leak of a single refcount during boot, with no functional impact. Annotate scu with the __free(device_node) cleanup attribute so the reference is released when the function returns. Found while reviewing a CodeQL report for vexpress_flags_set() on the same SMP bring-up path. Fixes: d2606f81d563 ("ARM: vexpress: Simplify SMP operations for DT-powered system") Assisted-by: LLM codeql Signed-off-by: Weigang He Reviewed-by: Liviu Dudau Link: https://patch.msgid.link/20260925173252.933705-3-geoffreyhe2@gmail.com Signed-off-by: Sudeep Holla --- arch/arm/mach-versatile/platsmp-vexpress.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm/mach-versatile/platsmp-vexpress.c b/arch/arm/mach-versatile/platsmp-vexpress.c index 1ee3c45e71c9..b810ad50b98c 100644 --- a/arch/arm/mach-versatile/platsmp-vexpress.c +++ b/arch/arm/mach-versatile/platsmp-vexpress.c @@ -61,8 +61,8 @@ static const struct of_device_id vexpress_smp_dt_scu_match[] __initconst = { static void __init vexpress_smp_dt_prepare_cpus(unsigned int max_cpus) { - struct device_node *scu = of_find_matching_node(NULL, - vexpress_smp_dt_scu_match); + struct device_node *scu __free(device_node) = + of_find_matching_node(NULL, vexpress_smp_dt_scu_match); if (scu) scu_enable(of_iomap(scu, 0));