[PATCH v2] irqchip/gic-v3-its: Drop ITS node reference on its_of_probe() errors

[Marc Zyngier]

On Tue, 03 Nov 2026 20:18:10 +0000,
Yuho Choi <oss.patchbox at gmail.com> wrote:
> 
> its_of_probe() walks the ITS nodes with of_find_matching_node(), which
> drops the reference on the previous node and returns the next one with
> its reference count raised. The loops are balanced when they run to the
> end, but the three error returns (a failed its_reset_one(), a failed
> its_node_init() and a failed its_probe_one()) leave with the current
> node still referenced.
> 
> Declare the iterator in each loop with __free(device_node), so that the
> reference is dropped whichever way the loop is left.
> 
> Fixes: c733ebb7cb67 ("irqchip/gic-v3-its: Reset each ITS's BASERn register before probe")
> Fixes: 9585a495ac93 ("irqchip/gic-v3-its: Split allocation from initialisation of its_node")
> Suggested-by: Marc Zyngier <maz at kernel.org>
> Signed-off-by: Yuho Choi <oss.patchbox at gmail.com>
> ---
> v2:
> - Use __free(device_node) on the loop iterators instead of adding
>   of_node_put() to each error return (Marc).
> - Rebased on v7.4-rc1.
> 
> v1: https://lore.kernel.org/r/20260923165447.619477-1-oss.patchbox@gmail.com
> 
> Compile-tested only (arm64 defconfig, W=1).
> 
>  drivers/irqchip/irq-gic-v3-its.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> index 282e4bafb084..7c5df91a317c 100644
> --- a/drivers/irqchip/irq-gic-v3-its.c
> +++ b/drivers/irqchip/irq-gic-v3-its.c
> @@ -5572,7 +5572,6 @@ static void its_node_destroy(struct its_node *its)
>  
>  static int __init its_of_probe(struct device_node *node)
>  {
> -	struct device_node *np;
>  	struct resource res;
>  	int err;
>  
> @@ -5582,7 +5581,8 @@ static int __init its_of_probe(struct device_node *node)
>  	 * reset, don't even try to go any further, as this could
>  	 * result in something even worse.
>  	 */
> -	for (np = of_find_matching_node(node, its_device_id); np;
> +	for (struct device_node *np __free(device_node) =
> +	     of_find_matching_node(node, its_device_id); np;

nit: please don't split assignments. Long lines are perfectly fine.

>  	     np = of_find_matching_node(np, its_device_id)) {
>  		if (!of_device_is_available(np) ||
>  		    !of_property_read_bool(np, "msi-controller") ||
> @@ -5594,7 +5594,8 @@ static int __init its_of_probe(struct device_node *node)
>  			return err;
>  	}
>  
> -	for (np = of_find_matching_node(node, its_device_id); np;
> +	for (struct device_node *np __free(device_node) =
> +	     of_find_matching_node(node, its_device_id); np;
>  	     np = of_find_matching_node(np, its_device_id)) {
>  		struct its_node *its;
>  

With that addressed:

Acked-by: Marc Zyngier <maz at kernel.org>

	M.

-- 
Without deviation from the norm, progress is not possible.