[PATCH v2] PCI: rcar-gen4: Fix device_node leak in rcar_gen4_pcie_host_msi_addr()

[Fuad Tabba <fuad.tabba@linux.dev>]

rcar_gen4_pcie_host_msi_addr() calls of_msi_xlate() with *msi_np NULL,
so it receives the MSI controller node with a reference held, and every
return past the NULL check leaks that reference, the success path
included. Declare msi_node with __free(device_node) so it's put on
every return.

Fixes: 8d6af27c0a73 ("PCI: rcar-gen4: Configure AXIINTC if iMSI-RX is not used")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-pci/20260905213855.8D6671F00A3D@smtp.kernel.org/
Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org> # Retronix R-Car V4H Sparrow Hawk
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---

Notes:
    Changes since v1:
    - Declare msi_node immediately before of_msi_xlate() rather than at the
      top of the function, as Jonathan asked on the iproc conversion [1].
    - Kept Marek's Tested-by and Reviewed-by, since the generated code
      differs only in the stack offsets of msi_node and res.
    
    [1] https://lore.kernel.org/all/20260923093433.00006cab@oss.qualcomm.com/

 drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
index fbe465a29068f..bb2fcfd6861ac 100644
--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
@@ -323,7 +323,6 @@ static struct rcar_gen4_pcie *rcar_gen4_pcie_alloc(struct platform_device *pdev)
 static int rcar_gen4_pcie_host_msi_addr(struct dw_pcie_rp *pp, u32 *msi_addr)
 {
 	struct dw_pcie *dw = to_dw_pcie_from_pp(pp);
-	struct device_node *msi_node = NULL;
 	struct device *dev = dw->dev;
 	struct resource res;
 	u64 addr;
@@ -333,6 +332,7 @@ static int rcar_gen4_pcie_host_msi_addr(struct dw_pcie_rp *pp, u32 *msi_addr)
 	 * Either the "msi-parent" or the "msi-map" phandle needs to exist
 	 * to obtain the MSI node.
 	 */
+	struct device_node *msi_node __free(device_node) = NULL;
 	of_msi_xlate(dev, &msi_node, 0);
 	if (!msi_node)
 		return -ENODEV;

base-commit: fd73f4a6659897191fa0d40695fe370925dd3780
-- 
2.39.5