of/irq: Fix device node refcount leak in of_irq_get_affinity()
PATCH 1/1 of/irq: Fix device node refcount leak in of_irq_get_affinity()
of_irq_parse_one() raises the refcount of the interrupt controller node on success, and of_irq_get_affinity() returns without putting it, so every call past the parse leaks one reference. It is reached from platform_get_irq_affinity(), used by arm_pmu, arm_spe_pmu and coresight-trbe.
Put it once irq_populate_fwspec_info() has run: no in-tree ->get_fwspec_info() returns a mask that lives in the node.
--- drivers/of/irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/of/irq.c +3 -1
@@ -563,7 +563,9 @@ const struct cpumask *of_irq_get_affinity(struct device_node *dev, int index)of_phandle_args_to_fwspec (oirq.np, oirq.args, oirq.args_count, &fwspec); -if (irq_populate_fwspec_info (&fwspec, &info)) + rc =irq_populate_fwspec_info (&fwspec, &info); +of_node_put (oirq.np); +if (rc)return NULL ;return info.affinity;
base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
Signature · 1 line
2.39.5
[email protected]
AI reviewThank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] Device node reference count leak when resolving MSI domain RID via 'msi-parent' fallback.
- [High] Pre-existing memory leak of device node reference in gic_irq_get_fwspec_info. --
commit 105954fbf27e6537ca0c4da266eb89a3c31643fd
Author: Fuad Tabba <[email protected]>
of/irq: Fix device node refcount leak in of_irq_get_affinity()
This commit fixes a device node reference count leak in of_irq_get_affinity(). The of_irq_parse_one() call raises the refcount of the interrupt controller node on success, and of_irq_get_affinity() returns without putting it. The fix drops the reference once irq_populate_fwspec_info() has run.
Quoted 5 lines
drivers/of/irq.c +0
-0
drivers/of/irq.c const struct cpumask *of_irq_get_affinity(struct device_node *dev, int index) · line 571
Quoted 10 lines
drivers/of/irq.c +3
-1@@ -563,7 +563,9 @@ const struct cpumask *of_irq_get_affinity(struct device_node *dev, int index)of_phandle_args_to_fwspec (oirq.np, oirq.args, oirq.args_count, &fwspec); -if (irq_populate_fwspec_info (&fwspec, &info)) + rc =irq_populate_fwspec_info (&fwspec, &info); +of_node_put (oirq.np); +if (rc)return NULL ;return info.affinity;
[Severity: High]
This isn't a bug introduced by this patch, but there appears to be a device node reference count leak when resolving MSI domain RID via msi-parent fallback.
drivers/pci/msi/irqdomain.c:pci_msi_domain_get_msi_rid()
Quoted 5 lines
of_node = irq_domain_get_of_node(domain); rid = of_node ? of_msi_xlate(&pdev->dev, &of_node, rid) : iort_msi_map_id(&pdev->dev, rid); return rid;
If the mapping falls back to msi-parent in of_msi_xlate(), the un-refcounted of_node pointer is overwritten with a newly refcounted pointer in of_check_msi_parent():
drivers/of/irq.c:of_check_msi_parent()
Quoted 5 lines
if (!ret) {
/* Return with a node reference held */
*msi_node = msi_spec.np;
return 0;
}Since pci_msi_domain_get_msi_rid() returns the mapped RID without calling of_node_put() on the updated of_node, does this leak the MSI controller device node on every invocation?
[Severity: High]
This is a pre-existing issue, but is there also a memory leak of the device node reference in gic_irq_get_fwspec_info()?
drivers/irqchip/irq-gic-v3.c:gic_irq_get_fwspec_info()
Quoted 13 lines
fw = of_fwnode_handle(of_find_node_by_phandle(fwspec->param[3]));
if (!fw)
return -ENOENT;
for (int i = 0; i < gic_data.nr_parts; i++) {
if (gic_data.parts[i].partition_id == fw) {
mask = &gic_data.parts[i].mask;
break;
}
}
if (!mask)
return -ENOENT;Quoted 8 lines
} else {
mask = cpu_possible_mask;
}
info->affinity = mask;
info->flags = IRQ_FWSPEC_INFO_AFFINITY_VALID;
return 0;The call to of_find_node_by_phandle() acquires a new reference on the device node, but the function returns on various error and success paths without calling of_node_put() to drop it. Does this leak the GIC PPI partition device nodes during IRQ affinity retrieval?
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
Sashiko,
Quoted 6 lines · On Wed, 26 Aug 2026 at 12:36, <[email protected]> wrote:
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] Device node reference count leak when resolving MSI domain RID via 'msi-parent' fallback.
- [High] Pre-existing memory leak of device node reference ingic_irq_get_fwspec_info.
...
Quoted 4 lines
[Severity: High]
This isn't a bug introduced by this patch, but there appears to be a device node reference count leak when resolving MSI domain RID via msi-parent fallback.
I think you're right, though not on every invocation. In this caller of_msi_xlate() only hands back an owned reference on the msi-parent
path: the msi-map branch is guarded on *msi_np being NULL, which it is not here, and of_check_msi_parent() puts the node itself when it fails.
Separate fix, and the question underneath is whether of_msi_xlate()'s ownership of *msi_np should be spelled out for all its callers rather than patched at this one.
Let me think about this though.
...
Quoted 3 lines
[Severity: High]
This is a pre-existing issue, but is there also a memory leak of the device node reference ingic_irq_get_fwspec_info()?
Yes, and I have a fix for that one written already. It goes to the irqchip maintainers in a separate posting, since it is a different subsystem to this patch.
Cheers,
/fuad
Quoted 31 lines
drivers/irqchip/irq-gic-v3.c:gic_irq_get_fwspec_info()
Quoted 13 lines
fw = of_fwnode_handle(of_find_node_by_phandle(fwspec->param[3])); if (!fw) return -ENOENT; for (int i = 0; i < gic_data.nr_parts; i++) { if (gic_data.parts[i].partition_id == fw) { mask = &gic_data.parts[i].mask; break; } } if (!mask) return -ENOENT;Quoted 8 lines
} else { mask = cpu_possible_mask; } info->affinity = mask; info->flags = IRQ_FWSPEC_INFO_AFFINITY_VALID; return 0;The call to
of_find_node_by_phandle()acquires a new reference on the device node, but the function returns on various error and success paths without callingof_node_put()to drop it. Does this leak the GIC PPI partition device nodes during IRQ affinity retrieval?--
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
Quoted 6 lines · Fuad Tabba
of_irq_parse_one()raises the refcount of the interrupt controller node on success, andof_irq_get_affinity()returns without putting it, so every call past the parse leaks one reference. It is reached fromplatform_get_irq_affinity(), used byarm_pmu,arm_spe_pmuand coresight-trbe.
Quoted 9 lines
Put it once
irq_populate_fwspec_info()has run: no in-tree ->get_fwspec_info() returns a mask that lives in the node.Fixes 5404f5c06dd4 ("of/irq: Add interrupt affinity reporting interface")Signed-off-by Fuad Tabba <[email protected]>--- drivers/of/irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
Applied, thanks!