Re: [PATCH] of/irq: Fix device node refcount leak in of_irq_get_affinity()

Sashiko,

On Wed, 26 Aug 2026 at 12:36, [off-list ref] wrote:

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Device node reference count leak when resolving MSI domain RID via 'msi-parent' fallback.
- [High] Pre-existing memory leak of device node reference in `gic_irq_get_fwspec_info`.

...

[Severity: High]
This isn't a bug introduced by this patch, but there appears to be a
device node reference count leak when resolving MSI domain RID via
msi-parent fallback.

I think you're right, though not on every invocation. In this caller
of_msi_xlate() only hands back an owned reference on the msi-parent
path: the msi-map branch is guarded on *msi_np being NULL, which it is
not here, and of_check_msi_parent() puts the node itself when it
fails.

Separate fix, and the question underneath is whether of_msi_xlate()'s
ownership of *msi_np should be spelled out for all its callers rather
than patched at this one.

Let me think about this though.

...

[Severity: High]
This is a pre-existing issue, but is there also a memory leak of the
device node reference in gic_irq_get_fwspec_info()?

Yes, and I have a fix for that one written already. It goes to the
irqchip maintainers in a separate posting, since it is a different
subsystem to this patch.

Cheers,
/fuad

drivers/irqchip/irq-gic-v3.c:gic_irq_get_fwspec_info()

quoted

              fw = of_fwnode_handle(of_find_node_by_phandle(fwspec->param[3]));
              if (!fw)
                      return -ENOENT;

              for (int i = 0; i < gic_data.nr_parts; i++) {
                      if (gic_data.parts[i].partition_id == fw) {
                              mask = &gic_data.parts[i].mask;
                              break;
                      }
              }

              if (!mask)
                      return -ENOENT;
      } else {
              mask = cpu_possible_mask;
      }

      info->affinity = mask;
      info->flags = IRQ_FWSPEC_INFO_AFFINITY_VALID;

      return 0;

The call to of_find_node_by_phandle() acquires a new reference on the
device node, but the function returns on various error and success paths
without calling of_node_put() to drop it. Does this leak the GIC PPI
partition device nodes during IRQ affinity retrieval?

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260826112234.1033974-1-fuad.tabba@linux.dev?part=1