Re: [PATCH v5 2/4] PCI: of: drop the reg_num argument to of_pci_set_address()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Leaked OF node reference counts in of_pci_prop_intr_map()
--

commit b3af32f45eed6da355a4a96246bdedb364fe0855
Author: Alex Elder <elder@riscstar.com>

PCI: of: drop the reg_num argument to of_pci_set_address()

The reg_num argument passed to of_pci_set_address() is always zero,
so get rid of it.

Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: Alex Elder <elder@riscstar.com>

> diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c
> index d66c702218081..1caabbd4c18b5 100644
> --- a/drivers/pci/of_property.c
> +++ b/drivers/pci/of_property.c

[ ... ]

[Severity: High]
This is a pre-existing issue, but does this code leak device node reference
counts in of_pci_prop_intr_map()?

When of_irq_parse_raw() successfully parses an interrupt, it acquires a
device node reference and stores it in out_irq[i].np:

drivers/pci/of_property.c:of_pci_prop_intr_map() {
    ...
		ret = of_irq_parse_raw(laddr, &out_irq[i]);
		if (ret) {
			out_irq[i].np = NULL;
			pci_dbg(pdev, "parse irq %d failed, ret %d", pin, ret);
			continue;
		}
    ...

However, the function returns without calling of_node_put() on the
successfully parsed nodes in the out_irq array. This leak occurs on all
return paths, such as when map_sz is zero or when kcalloc() fails:

    ...
	if (!map_sz)
		return 0;

	int_map = kcalloc(map_sz, sizeof(u32), GFP_KERNEL);
	if (!int_map)
		return -ENOMEM;
    ...

Are we missing calls to of_node_put() for these references before
returning?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908213459.2519059-1-elder@riscstar.com?part=2