[PATCH v1] ARM: l2x0: Fix OF node reference leak in l2x0_of_init

Yuho Choi dbgh9129 at gmail.com
Sun Jun 7 21:23:30 PDT 2026


l2x0_of_init() gets the cache controller node with
of_find_matching_node(), which returns the node with a reference held.
The node is only needed while parsing the cache controller resources and
properties, but the function returns without dropping that reference on
the resource/ioremap failure paths or after __l2c_init() returns.

Use a single exit path after the node lookup and put the node before
returning.

Fixes: 8c369264b6de ("ARM: 7009/1: l2x0: Add OF based initialization")
Signed-off-by: Yuho Choi <dbgh9129 at gmail.com>
---
 arch/arm/mm/cache-l2x0.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index 470867160076..e20ac79dd500 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -1767,17 +1767,22 @@ int __init l2x0_of_init(u32 aux_val, u32 aux_mask)
 	u32 cache_id, old_aux;
 	u32 cache_level = 2;
 	bool nosync = false;
+	int ret;
 
 	np = of_find_matching_node(NULL, l2x0_ids);
 	if (!np)
 		return -ENODEV;
 
-	if (of_address_to_resource(np, 0, &res))
-		return -ENODEV;
+	if (of_address_to_resource(np, 0, &res)) {
+		ret = -ENODEV;
+		goto out_put_node;
+	}
 
 	l2x0_base = ioremap(res.start, resource_size(&res));
-	if (!l2x0_base)
-		return -ENOMEM;
+	if (!l2x0_base) {
+		ret = -ENOMEM;
+		goto out_put_node;
+	}
 
 	l2x0_saved_regs.phy_base = res.start;
 
@@ -1821,6 +1826,10 @@ int __init l2x0_of_init(u32 aux_val, u32 aux_mask)
 	else
 		cache_id = readl_relaxed(l2x0_base + L2X0_CACHE_ID);
 
-	return __l2c_init(data, aux_val, aux_mask, cache_id, nosync);
+	ret = __l2c_init(data, aux_val, aux_mask, cache_id, nosync);
+
+out_put_node:
+	of_node_put(np);
+	return ret;
 }
 #endif
-- 
2.43.0




More information about the linux-arm-kernel mailing list