From cbe0f79dcab1c121d767927b53a61eadf2c5b518 Mon Sep 17 00:00:00 2001 From: Fuad Tabba Date: Mon, 7 Sep 2026 12:29:43 +0100 Subject: [PATCH] of/irq: Fix device node refcount leak in of_check_msi_parent() of_msi_xlate() documents @msi_np as a filter when it points at a node on entry, handing back a reference only when it points at NULL. The msi-map branch does that. of_check_msi_parent() keeps the reference from the 1:1 msi-parent match either way. pci_msi_domain_get_msi_rid() is the only caller that passes a node in, from irq_domain_get_of_node(), and it puts nothing, so a 1:1 match there leaks the MSI controller node. Fixes: 119aaeed0b67 ("of/irq: Add msi-parent check to of_msi_xlate()") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260826113604.010C01F000E9@smtp.kernel.org/ Signed-off-by: Fuad Tabba Link: https://lore.kernel.org/all/20260826113604.010C01F000E9@smtp.kernel.org/ Link: https://patch.msgid.link/20260907112944.313618-2-fuad.tabba@linux.dev Signed-off-by: Rob Herring (Arm) --- drivers/of/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index ec035367c950..109c54f34647 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -785,7 +785,7 @@ static int of_check_msi_parent(struct device_node *dev_node, struct device_node if ((*msi_node && *msi_node != msi_spec.np) || msi_spec.args_count != 0) ret = -EINVAL; - if (!ret) { + if (!ret && !*msi_node) { /* Return with a node reference held */ *msi_node = msi_spec.np; return 0;