[Bug] GICv3 ITS cleanup path removes list node after freeing it

[K-ANOY]

RT-Thread Version

v5.0.2-2673-gac6dc197a0

Hardware Type/Architectures

Likely affects ARM platforms using the GICv3 ITS driver. The issue is in: components/drivers/pic/pic-gicv3-its.c

Develop Toolchain

Other

Describe the bug

In components/drivers/pic/pic-gicv3-its.c, the _free_all cleanup path in gicv3_its_ofw_probe() frees each struct gicv3_its object before removing its embedded list node:

_free_all:
    rt_list_for_each_entry_safe(its, its_next, &its_nodes, list)
    {
        rt_free(its);
        rt_list_remove(&its->list);
    }

    return err;

After rt_free(its), accessing its->list in rt_list_remove(&its->list) is a use-after-free.

The same file already has a helper that uses the safe order and also releases associated resources:

static void its_init_fail(struct gicv3_its *its)
{
    if (its->base)
    {
        rt_iounmap(its->base);
    }

    if (its->cmd_base)
    {
        rt_free_align(its->cmd_base);
    }

    for (int i = 0; i < RT_ARRAY_SIZE(its->tbls); ++i)
    {
        struct its_table *tbl = &its->tbls[i];

        if (tbl->base)
        {
            rt_free_align(tbl->base);
        }
    }

    rt_list_remove(&its->list);
    rt_free(its);
}

The _free_all branch should not free its before using its->list.

Other additional context

No response