From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta0.migadu.com (out-72.mta0.migadu.com [91.218.175.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ECBA5397944 for ; Fri, 4 Sep 2026 07:34:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.72 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788507274; cv=none; b=pcMXIZQ8GBFhdp+Y7CHUtjFcH2FKmbSEPSGZXRiG3sN1/5DizSKpmLhm0D69qnjiadJp86mT9kcS8iOtBBT9WlDqQHI3aS8alFiA+evpAVAIvyUMIt3Bp9JyPAOV9HPPj1zZoaZurC0OOGzuqaxMXj1d0aIuCvaQhov2qHk945I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788507274; c=relaxed/simple; bh=LY8f5W+7LtN+ULoAR4gplhH8mdUjEyFtTXcvRCeW2vQ=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=bXWlcjPZWjGe8gmJblrsAOArlSHa9psHOMars1EaM26QSIJkqkWVJzRU5cz0N6R6JXNuxsKS5AuSqpj/8xiobQRGEcjwbz4Ebr8uVPwR078Iq/D7uZ4PSNGEtpuibIdhC3jtlEDQ+Wq9+vgyt+qWW+lz7xDHre0m1G1pEkSCBYA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=hQ8zj9Dq; arc=none smtp.client-ip=91.218.175.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="hQ8zj9Dq" X-Envelope-To: devicetree@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=LY8f5W+7LtN+ULoAR4gplhH8mdUjEyFtTXcvRCeW2vQ=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788507268; v=1; x=1789112068; b=hQ8zj9DqFIF1gQmMHDN3m1U5zGjJxnSpPsbYEToXy0m6ZilADEDZVdBNYFi/Vxo771ZWQhQx ou8M6itLa33BrS8R3cduUrDLye+v86vQTr2va9z2hTB5wIadRB33RLneVJOBhTd/5spl569cD2a sgFMbLc8YVy+oMwzKJS6LIyA= X-Envelope-To: devicetree@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 2187e54158d3cfa3; Fri, 04 Sep 2026 07:34:28 +0000 X-Mizu-Trace-ID: 2187e54158d3cfa3 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Rob Herring , Saravana Kannan Cc: Lorenzo Pieralisi , Frank Li , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Fuad Tabba Subject: [PATCH] of/irq: Fix device node refcount leak in of_check_msi_parent() Date: Fri, 4 Sep 2026 08:34:24 +0100 Message-Id: <20260904073424.3855365-1-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit of_msi_xlate() documents @msi_np as a filter when it points at a node on entry, handing back a reference only when it points at NULL. The msi-map branch does that. of_check_msi_parent() keeps the reference from the 1:1 msi-parent match either way. pci_msi_domain_get_msi_rid() is the only caller that passes a node in, from irq_domain_get_of_node(), and it puts nothing, so a 1:1 match there leaks the MSI controller node. Fixes: 119aaeed0b67 ("of/irq: Add msi-parent check to of_msi_xlate()") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260826113604.010C01F000E9@smtp.kernel.org/ Signed-off-by: Fuad Tabba --- drivers/of/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index ec035367c9500..109c54f346479 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -785,7 +785,7 @@ static int of_check_msi_parent(struct device_node *dev_node, struct device_node if ((*msi_node && *msi_node != msi_spec.np) || msi_spec.args_count != 0) ret = -EINVAL; - if (!ret) { + if (!ret && !*msi_node) { /* Return with a node reference held */ *msi_node = msi_spec.np; return 0; -- 2.39.5