* [PATCH v1] bus: arm-cci: Fix OF node refcount leak in cci_probe()
@ 2026-05-01 18:27 Yuho Choi
0 siblings, 0 replies; only message in thread
From: Yuho Choi @ 2026-05-01 18:27 UTC (permalink / raw)
To: Kees Cook; +Cc: linux-kernel, Yuho Choi
of_find_matching_node() returns a device node with its reference count
incremented. cci_probe() returns without dropping that reference when
the matched node is unavailable, when controller mapping fails, and
after cci_probe_ports() returns.
Route all exits after the lookup through a common cleanup label and drop
the node with of_node_put(). This is also safe for the no-match case
because of_node_put(NULL) is allowed.
Fixes: ed69bdd8fd9b ("drivers: bus: add ARM CCI support")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
drivers/bus/arm-cci.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c
index 7f2baf057128..f5993380d511 100644
--- a/drivers/bus/arm-cci.c
+++ b/drivers/bus/arm-cci.c
@@ -538,8 +538,10 @@ static int cci_probe(void)
struct resource res;
np = of_find_matching_node(NULL, arm_cci_matches);
- if (!of_device_is_available(np))
- return -ENODEV;
+ if (!of_device_is_available(np)) {
+ ret = -ENODEV;
+ goto out_put_node;
+ }
ret = of_address_to_resource(np, 0, &res);
if (!ret) {
@@ -548,10 +550,15 @@ static int cci_probe(void)
}
if (ret || !cci_ctrl_base) {
WARN(1, "unable to ioremap CCI ctrl\n");
- return -ENXIO;
+ ret = -ENXIO;
+ goto out_put_node;
}
- return cci_probe_ports(np);
+ ret = cci_probe_ports(np);
+
+out_put_node:
+ of_node_put(np);
+ return ret;
}
static int cci_init_status = -EAGAIN;
--
2.43.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-05-01 18:27 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-01 18:27 [PATCH v1] bus: arm-cci: Fix OF node refcount leak in cci_probe() Yuho Choi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox