[PATCH v1] irqchip/gic-v3-its: Fix OF node reference leak

[PATCH v1] irqchip/gic-v3-its: Fix OF node reference leak

[Yuho Choi]

of_get_cpu_node() returns a referenced device node. In
its_cpu_init_collection(), the node is only used to get the CPU NUMA
node for the Cavium 23144 workaround, but the reference is never
dropped.

Store the NUMA node locally and call of_node_put() before either
continuing with collection setup or returning early for a NUMA mismatch.

Fixes: 920181ce8469 ("irqchip/gic-v3-its: Add ability to resend MAPC on resume")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 drivers/irqchip/irq-gic-v3-its.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index b57d81ad33a0..f82035eb77e5 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3291,10 +3291,14 @@ static void its_cpu_init_collection(struct its_node *its)
 	/* avoid cross node collections and its mapping */
 	if (its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144) {
 		struct device_node *cpu_node;
+		int cpu_nid;
 
 		cpu_node = of_get_cpu_node(cpu, NULL);
+		cpu_nid = of_node_to_nid(cpu_node);
+		of_node_put(cpu_node);
+
 		if (its->numa_node != NUMA_NO_NODE &&
-			its->numa_node != of_node_to_nid(cpu_node))
+		    its->numa_node != cpu_nid)
 			return;
 	}
 
-- 
2.43.0

Re: [PATCH v1] irqchip/gic-v3-its: Fix OF node reference leak

[Marc Zyngier]

On Fri, 19 Jun 2026 19:58:08 +0100,
Yuho Choi <dbgh9129@gmail.com> wrote:
> 
> of_get_cpu_node() returns a referenced device node. In
> its_cpu_init_collection(), the node is only used to get the CPU NUMA
> node for the Cavium 23144 workaround, but the reference is never
> dropped.
> 
> Store the NUMA node locally and call of_node_put() before either
> continuing with collection setup or returning early for a NUMA mismatch.
> 
> Fixes: 920181ce8469 ("irqchip/gic-v3-its: Add ability to resend MAPC on resume")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
> ---
>  drivers/irqchip/irq-gic-v3-its.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> index b57d81ad33a0..f82035eb77e5 100644
> --- a/drivers/irqchip/irq-gic-v3-its.c
> +++ b/drivers/irqchip/irq-gic-v3-its.c
> @@ -3291,10 +3291,14 @@ static void its_cpu_init_collection(struct its_node *its)
>  	/* avoid cross node collections and its mapping */
>  	if (its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144) {
>  		struct device_node *cpu_node;
> +		int cpu_nid;
>  
>  		cpu_node = of_get_cpu_node(cpu, NULL);
> +		cpu_nid = of_node_to_nid(cpu_node);
> +		of_node_put(cpu_node);
> +
>  		if (its->numa_node != NUMA_NO_NODE &&
> -			its->numa_node != of_node_to_nid(cpu_node))
> +		    its->numa_node != cpu_nid)
>  			return;
>  	}
>

Please consider using the cleanup infrastructure instead, something
like the untested hack below.

Thanks,

	M.

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 291d7668cc8da..947a15bb42012 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3290,11 +3290,10 @@ static void its_cpu_init_collection(struct its_node *its)
 
 	/* avoid cross node collections and its mapping */
 	if (its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144) {
-		struct device_node *cpu_node;
+		struct device_node *cpu_node __free(device_node) = of_get_cpu_node(cpu, NULL);
 
-		cpu_node = of_get_cpu_node(cpu, NULL);
 		if (its->numa_node != NUMA_NO_NODE &&
-			its->numa_node != of_node_to_nid(cpu_node))
+		    its->numa_node != of_node_to_nid(cpu_node))
 			return;
 	}
 

-- 
Jazz isn't dead. It just smells funny.

Re: [PATCH v1] irqchip/gic-v3-its: Fix OF node reference leak

[Zenghui Yu]

On 6/20/26 4:59 PM, Marc Zyngier wrote:
> On Fri, 19 Jun 2026 19:58:08 +0100,
> Yuho Choi <dbgh9129@gmail.com> wrote:
> >
> > of_get_cpu_node() returns a referenced device node. In
> > its_cpu_init_collection(), the node is only used to get the CPU NUMA
> > node for the Cavium 23144 workaround, but the reference is never
> > dropped.
> >
> > Store the NUMA node locally and call of_node_put() before either
> > continuing with collection setup or returning early for a NUMA mismatch.
> >
> > Fixes: 920181ce8469 ("irqchip/gic-v3-its: Add ability to resend MAPC on resume")

It looks to me that this issue was introduced in fbf8f40e1658
("irqchip/gicv3-its: numa: Enable workaround for Cavium thunderx erratum
23144"). What am I missing?

> > Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
> > ---
> >  drivers/irqchip/irq-gic-v3-its.c | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> > index b57d81ad33a0..f82035eb77e5 100644
> > --- a/drivers/irqchip/irq-gic-v3-its.c
> > +++ b/drivers/irqchip/irq-gic-v3-its.c
> > @@ -3291,10 +3291,14 @@ static void its_cpu_init_collection(struct its_node *its)
> >  	/* avoid cross node collections and its mapping */
> >  	if (its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144) {
> >  		struct device_node *cpu_node;
> > +		int cpu_nid;
> >  
> >  		cpu_node = of_get_cpu_node(cpu, NULL);
> > +		cpu_nid = of_node_to_nid(cpu_node);
> > +		of_node_put(cpu_node);
> > +
> >  		if (its->numa_node != NUMA_NO_NODE &&
> > -			its->numa_node != of_node_to_nid(cpu_node))
> > +		    its->numa_node != cpu_nid)
> >  			return;
> >  	}
> >
> 
> Please consider using the cleanup infrastructure instead, something
> like the untested hack below.
> 
> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> index 291d7668cc8da..947a15bb42012 100644
> --- a/drivers/irqchip/irq-gic-v3-its.c
> +++ b/drivers/irqchip/irq-gic-v3-its.c
> @@ -3290,11 +3290,10 @@ static void its_cpu_init_collection(struct its_node *its)
>  
>  	/* avoid cross node collections and its mapping */
>  	if (its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144) {
> -		struct device_node *cpu_node;
> +		struct device_node *cpu_node __free(device_node) = of_get_cpu_node(cpu, NULL);
>  
> -		cpu_node = of_get_cpu_node(cpu, NULL);
>  		if (its->numa_node != NUMA_NO_NODE &&
> -			its->numa_node != of_node_to_nid(cpu_node))
> +		    its->numa_node != of_node_to_nid(cpu_node))
>  			return;
>  	}
>  

Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev>

Thanks,
Zenghui