Thread (4 messages) 4 messages, 2 authors, 2026-06-10
COLD45d

[PATCH 1/2] ARM: mstar: fix device_node refcount leak in mstarv7_boot_secondary()

From: Weigang He <hidden>
Date: 2026-06-10 05:33:35
Also in: lkml
Subsystem: arm port, arm/mstar/sigmastar armv7 soc support, the rest · Maintainers: Russell King, Daniel Palmer, Romain Perier, Linus Torvalds

of_find_compatible_node() returns a device_node with its refcount
incremented; the caller must drop it with of_node_put() when done.
mstarv7_boot_secondary() obtains the "mstar,smpctrl" node, maps it with
of_iomap() and never releases the reference, leaking it on both the
-ENODEV error path and the success path.

mstar SoCs do not support CPU hot-unplug (mstarv7_smp_ops provides no
.cpu_die), so this leaks one refcount on the smpctrl node once per boot
when the secondary CPU is brought up.

Drop the reference right after of_iomap(), since np is not used
afterwards.

Found by static analysis tool CodeQL.

Fixes: 5919eec0f092 ("ARM: mstar: SMP support")
Signed-off-by: Weigang He <redacted>
---
 arch/arm/mach-mstar/mstarv7.c | 1 +
 1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-mstar/mstarv7.c b/arch/arm/mach-mstar/mstarv7.c
index 274c4f0df270f..871c0fd258e66 100644
--- a/arch/arm/mach-mstar/mstarv7.c
+++ b/arch/arm/mach-mstar/mstarv7.c
@@ -86,6 +86,7 @@ static int mstarv7_boot_secondary(unsigned int cpu, struct task_struct *idle)
 
 	np = of_find_compatible_node(NULL, NULL, "mstar,smpctrl");
 	smpctrl = of_iomap(np, 0);
+	of_node_put(np);
 
 	if (!smpctrl)
 		return -ENODEV;
-- 
2.43.0

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help