Re: [PATCH RFC 05/15] arm_mpam: Fix device_node refcount in DT resource parsing

From: Yin Li

Date: Thu Sep 03 2026 - 04:16:25 EST




On 9/2/2026 9:29 PM, Andre Przywara wrote:
Hi,

On 8/11/26 15:30, Yin Li wrote:
When a cache-parented or memory-controller-parented MSC is probed via
device tree, the parent node was assigned directly to a
__free(device_node) variable without incrementing its reference count.
Both the parent and the cache/memory variable are declared with
__free(device_node), which causes the compiler to automatically insert
an of_node_put() call for each variable when they go out of scope.
Since both variables point to the same node but the reference count was
only incremented once by of_get_parent(), the node ends up being
released twice, causing a refcount underflow.

Yes, looks about right: there is another assignment to both memory and cache, they call of_parse_phandle(), which increments the refcount, so we need to do the same for the direct assignments, to get the free'ing done consistently.

Use of_node_get() to take an explicit reference so each __free variable
holds its own reference.

Signed-off-by: Yin Li <yin.li@xxxxxxxxxxxxxxxx>

Reviewed-by: Andre Przywara <andre.przywara@xxxxxxx>


Hi Andre,

Thanks for the review and the Reviewed-by tag.

... though this should definitely be squashed into the respective DT patches. Feel free to do so.


You're right that these fixes should be squashed into the respective
DT patches. I kept them as separate fix patches for now because those
DT patches are based on James Morse's and Shanker's original unmerged
work — this way the changes I made on top are easier to review in
isolation. I plan to fold them back into the original patches once
James and Shanker have had a chance to respond.

Cheers,
Andre

---
  drivers/resctrl/mpam_devices.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/resctrl/mpam_devices.c b/drivers/resctrl/ mpam_devices.c
index 975ddab771b4..559fa09128b4 100644
--- a/drivers/resctrl/mpam_devices.c
+++ b/drivers/resctrl/mpam_devices.c
@@ -280,7 +280,7 @@ static int mpam_dt_parse_resource(struct mpam_msc *msc, struct device_node *np,
          type = MPAM_CLASS_CACHE;
      } else if (of_device_is_compatible(parent, "cache")) {
-        cache = parent;
+        cache = of_node_get(parent);
          type = MPAM_CLASS_CACHE;
      } else if (of_device_is_compatible(np, "arm,mpam-memory")) {
          memory = of_parse_phandle(np, "arm,mpam-device", 0);
@@ -290,7 +290,7 @@ static int mpam_dt_parse_resource(struct mpam_msc *msc, struct device_node *np,
          }
          type = MPAM_CLASS_MEMORY;
      } else if (of_device_is_compatible(np, "arm,mpam-memory- controller-msc")) {
-        memory = parent;
+        memory = of_node_get(parent);
          type = MPAM_CLASS_MEMORY;
      } else {
          /*



--
Thx and BRs,
Yin