[PATCH v3] powerpc/mpic: Fix memory leak of mpic on error paths

[PATCH v3] powerpc/mpic: Fix memory leak of mpic on error paths

[Jyoti Gupta]

mpic_alloc() allocates struct mpic (and optionally the protected
sources bitmap) but does not free them when mpic_setup_error_int() or
irq_domain_create_linear() fails, leaking the memory.

Free the bitmap and the mpic in the common error path before
dropping the device node reference.

Fixes: 996983b75ceb ("powerpc/mpic: Search for open-pic device-tree node if NULL")
Signed-off-by: Jyoti Gupta <jyoti@linux.ibm.com>
---

Changelog
===========
v2->v3:
 + Introduce 'err_free_mpic' unwind label to cleanly free mpic and mpic->protected
 + Link to v2: https://lore.kernel.org/all/20260930180919.335930-1-jyoti@linux.ibm.com/ 
 
---
---
arch/powerpc/sysdev/mpic.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 257886ec3f70..d799cf4da7bd 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -1389,7 +1389,7 @@ struct mpic * __init mpic_alloc(struct device_node *node,
 		if (fsl_version >= 0x401) {
 			ret = mpic_setup_error_int(mpic, intvec_top - 13);
 			if (ret)
-				return NULL;
+				goto err_free_mpic;
 		}
 
 	}
@@ -1488,12 +1488,8 @@ struct mpic * __init mpic_alloc(struct device_node *node,
 						 intvec_top,
 						 &mpic_host_ops, mpic);
 
-	/*
-	 * FIXME: The code leaks the MPIC object and mappings here; this
-	 * is very unlikely to fail but it ought to be fixed anyways.
-	 */
 	if (mpic->irqhost == NULL)
-		return NULL;
+		goto err_free_mpic;
 
 	/* Display version */
 	switch (greg_feature & MPIC_GREG_FEATURE_VERSION_MASK) {
@@ -1526,6 +1522,9 @@ struct mpic * __init mpic_alloc(struct device_node *node,
 
 	return mpic;
 
+err_free_mpic:
+	bitmap_free(mpic->protected);
+	kfree(mpic);
 err_of_node_put:
 	of_node_put(node);
 	return NULL;
-- 
2.55.0

Re: [PATCH v3] powerpc/mpic: Fix memory leak of mpic on error paths

[Mukesh Kumar Chaurasiya]

On Tue, Oct 06, 2026 at 12:29:45PM +0530, Jyoti Gupta wrote:
> mpic_alloc() allocates struct mpic (and optionally the protected
> sources bitmap) but does not free them when mpic_setup_error_int() or
> irq_domain_create_linear() fails, leaking the memory.
> 
> Free the bitmap and the mpic in the common error path before
> dropping the device node reference.
> 
> Fixes: 996983b75ceb ("powerpc/mpic: Search for open-pic device-tree node if NULL")
> Signed-off-by: Jyoti Gupta <jyoti@linux.ibm.com>
> ---
> 
> Changelog
> ===========
> v2->v3:
>  + Introduce 'err_free_mpic' unwind label to cleanly free mpic and mpic->protected
>  + Link to v2: https://lore.kernel.org/all/20260930180919.335930-1-jyoti@linux.ibm.com/ 
>  
> ---
> ---
> arch/powerpc/sysdev/mpic.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
> index 257886ec3f70..d799cf4da7bd 100644
> --- a/arch/powerpc/sysdev/mpic.c
> +++ b/arch/powerpc/sysdev/mpic.c
> @@ -1389,7 +1389,7 @@ struct mpic * __init mpic_alloc(struct device_node *node,
>  		if (fsl_version >= 0x401) {
>  			ret = mpic_setup_error_int(mpic, intvec_top - 13);
>  			if (ret)
> -				return NULL;
> +				goto err_free_mpic;
>  		}
>  
>  	}
> @@ -1488,12 +1488,8 @@ struct mpic * __init mpic_alloc(struct device_node *node,
>  						 intvec_top,
>  						 &mpic_host_ops, mpic);
>  
> -	/*
> -	 * FIXME: The code leaks the MPIC object and mappings here; this
> -	 * is very unlikely to fail but it ought to be fixed anyways.
> -	 */
>  	if (mpic->irqhost == NULL)
> -		return NULL;
> +		goto err_free_mpic;
>  
>  	/* Display version */
>  	switch (greg_feature & MPIC_GREG_FEATURE_VERSION_MASK) {
> @@ -1526,6 +1522,9 @@ struct mpic * __init mpic_alloc(struct device_node *node,
>  
>  	return mpic;
>  
> +err_free_mpic:
> +	bitmap_free(mpic->protected);
> +	kfree(mpic);
>  err_of_node_put:
>  	of_node_put(node);
>  	return NULL;
> -- 
> 2.55.0
> 
Yeah, this looks clean.

Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>

Re: [PATCH v3] powerpc/mpic: Fix memory leak of mpic on error paths

[Amit Machhiwal]

On 2026/10/06 12:29 PM, Jyoti Gupta wrote:
> mpic_alloc() allocates struct mpic (and optionally the protected
> sources bitmap) but does not free them when mpic_setup_error_int() or
> irq_domain_create_linear() fails, leaking the memory.
> 
> Free the bitmap and the mpic in the common error path before
> dropping the device node reference.
> 
> Fixes: 996983b75ceb ("powerpc/mpic: Search for open-pic device-tree node if NULL")
> Signed-off-by: Jyoti Gupta <jyoti@linux.ibm.com>
> ---

Thanks for updating this to use layered error labels.  The patch looks clean and
good to me now.

Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>

Thanks,
Amit

Re: [PATCH v3] powerpc/mpic: Fix memory leak of mpic on error paths

[Ritesh Harjani]

Jyoti Gupta <jyoti@linux.ibm.com> writes:

> mpic_alloc() allocates struct mpic (and optionally the protected
> sources bitmap) but does not free them when mpic_setup_error_int() or
> irq_domain_create_linear() fails, leaking the memory.
>
> Free the bitmap and the mpic in the common error path before
> dropping the device node reference.
>
> Fixes: 996983b75ceb ("powerpc/mpic: Search for open-pic device-tree node if NULL")
> Signed-off-by: Jyoti Gupta <jyoti@linux.ibm.com>
> ---
>
> Changelog
> ===========
> v2->v3:
>  + Introduce 'err_free_mpic' unwind label to cleanly free mpic and mpic->protected
>  + Link to v2: https://lore.kernel.org/all/20260930180919.335930-1-jyoti@linux.ibm.com/ 
>  
> ---
> ---
> arch/powerpc/sysdev/mpic.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
> index 257886ec3f70..d799cf4da7bd 100644
> --- a/arch/powerpc/sysdev/mpic.c
> +++ b/arch/powerpc/sysdev/mpic.c
> @@ -1389,7 +1389,7 @@ struct mpic * __init mpic_alloc(struct device_node *node,
>  		if (fsl_version >= 0x401) {
>  			ret = mpic_setup_error_int(mpic, intvec_top - 13);
>  			if (ret)
> -				return NULL;
> +				goto err_free_mpic;
>  		}
>  
>  	}
> @@ -1488,12 +1488,8 @@ struct mpic * __init mpic_alloc(struct device_node *node,
>  						 intvec_top,
>  						 &mpic_host_ops, mpic);
>  
> -	/*
> -	 * FIXME: The code leaks the MPIC object and mappings here; this
> -	 * is very unlikely to fail but it ought to be fixed anyways.
> -	 */

I don't think the current change fixes leaked mappings for
!CONFIG_PPC_DCR or !MPIC_USES_DCR. So removing this comment completely
doesn't look correct.
And maybe unless we have the HW or a way to really validate this - not
sure whether it is worth working on a full error handling routine to
unmap all the mappings from ioremap().

In that case, in this patch at-least, I think we should still keep this
comment i.e.:

/*
 * FIXME: The code leaks the MPIC mappings here; this is very unlikely
 * to fail but it ought to be fixed anyways.
 */

With that comment fixed - the change looks good to me, as it still fixes
the memory leak in error handling path. So feel free to add:

Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>


>  	if (mpic->irqhost == NULL)
> -		return NULL;
> +		goto err_free_mpic;
>  
>  	/* Display version */
>  	switch (greg_feature & MPIC_GREG_FEATURE_VERSION_MASK) {
> @@ -1526,6 +1522,9 @@ struct mpic * __init mpic_alloc(struct device_node *node,
>  
>  	return mpic;
>  
> +err_free_mpic:
> +	bitmap_free(mpic->protected);
> +	kfree(mpic);
>  err_of_node_put:
>  	of_node_put(node);
>  	return NULL;
> -- 
> 2.55.0