Re: [PATCH 1/2] ARM: vexpress: fix device_node refcount leak in vexpress_flags_set()

[Liviu Dudau]

On Sat, Sep 26, 2026 at 03:32:51AM +1000, Weigang He wrote:
> vexpress_flags_set() obtains a reference to the "arm,vexpress-sysreg"
> device node via of_find_compatible_node() and passes it to of_iomap(),
> but never calls of_node_put() on it. of_iomap() only reads the node's
> reg property to create the mapping and does not take ownership, so the
> node reference is leaked. The function runs from the __init SMP prepare
> path and caches the mapping in a static, so this is a one-shot leak of a
> single refcount during boot, with no functional impact.
> 
> The lookup was added to drivers/mfd/vexpress-sysreg.c by the commit
> below and later moved here by commit 9b06fc39084e ("ARM: vexpress: Move
> vexpress_flags_set() into arch code").
> 
> Annotate node with the __free(device_node) cleanup attribute so the
> reference is released when it goes out of scope.
> 
> Found by static analysis tool CodeQL.
> 
> Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
> Assisted-by: LLM codeql
> Signed-off-by: Weigang He <geoffreyhe2@xxxxxxxxx>

Reviewed-by: Liviu Dudau <liviu.dudau@xxxxxxx>

Best regards,
Liviu

> ---
> 
> Notes:
>     Compile-tested only (ARCH=arm multi_v7_defconfig, W=1). Not tested on
>     hardware; I have no Versatile Express board.
>     
>     The CodeQL query behind this report was synthesized with LLM assistance,
>     and the fix and changelog were drafted with LLM assistance; I have
>     reviewed them.
> 
>  arch/arm/mach-versatile/v2m.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm/mach-versatile/v2m.c b/arch/arm/mach-versatile/v2m.c
> index 79afdf2a90b6f..c86b38386cf7c 100644
> --- a/arch/arm/mach-versatile/v2m.c
> +++ b/arch/arm/mach-versatile/v2m.c
> @@ -13,8 +13,8 @@ void vexpress_flags_set(u32 data)
>  	static void __iomem *base;
>  
>  	if (!base) {
> -		struct device_node *node = of_find_compatible_node(NULL, NULL,
> -				"arm,vexpress-sysreg");
> +		struct device_node *node __free(device_node) =
> +			of_find_compatible_node(NULL, NULL, "arm,vexpress-sysreg");
>  
>  		base = of_iomap(node, 0);
>  	}
> -- 
> 2.43.0
> 

-- 
====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯