Re: [PATCH 2/2] ARM: vexpress: fix device_node refcount leak in vexpress_smp_dt_prepare_cpus()

[Liviu Dudau]

On Sat, Sep 26, 2026 at 03:32:52AM +1000, Weigang He wrote:
> vexpress_smp_dt_prepare_cpus() obtains a reference to the SCU device
> node via of_find_matching_node() and passes it to of_iomap(), but never
> calls of_node_put() on it. of_iomap() does not take ownership of the
> node, so the reference is leaked. The function is the .smp_prepare_cpus
> hook invoked once from the __init SMP bring-up path, so this is a
> one-shot leak of a single refcount during boot, with no functional
> impact.
> 
> Annotate scu with the __free(device_node) cleanup attribute so the
> reference is released when the function returns.
> 
> Found while reviewing a CodeQL report for vexpress_flags_set() on the
> same SMP bring-up path.
> 
> Fixes: d2606f81d563 ("ARM: vexpress: Simplify SMP operations for DT-powered system")
> Assisted-by: LLM codeql
> Signed-off-by: Weigang He <geoffreyhe2@xxxxxxxxx>

Reviewed-by: Liviu Dudau <liviu.dudau@xxxxxxx>

Best regards,
Liviu

> ---
> 
> Notes:
>     Compile-tested only (ARCH=arm multi_v7_defconfig, W=1). Not tested on
>     hardware; I have no Versatile Express board.
>     
>     The CodeQL query behind this report was synthesized with LLM assistance,
>     and the fix and changelog were drafted with LLM assistance; I have
>     reviewed them.
> 
>  arch/arm/mach-versatile/platsmp-vexpress.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm/mach-versatile/platsmp-vexpress.c b/arch/arm/mach-versatile/platsmp-vexpress.c
> index 1ee3c45e71c99..b810ad50b98ce 100644
> --- a/arch/arm/mach-versatile/platsmp-vexpress.c
> +++ b/arch/arm/mach-versatile/platsmp-vexpress.c
> @@ -61,8 +61,8 @@ static const struct of_device_id vexpress_smp_dt_scu_match[] __initconst = {
>  
>  static void __init vexpress_smp_dt_prepare_cpus(unsigned int max_cpus)
>  {
> -	struct device_node *scu = of_find_matching_node(NULL,
> -			vexpress_smp_dt_scu_match);
> +	struct device_node *scu __free(device_node) =
> +		of_find_matching_node(NULL, vexpress_smp_dt_scu_match);
>  
>  	if (scu)
>  		scu_enable(of_iomap(scu, 0));
> -- 
> 2.43.0
> 

-- 
====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯