diff options
| author | Wei Li <unsw.weili@gmail.com> | 2026-01-20 08:07:35 +0000 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2026-03-04 07:20:13 -0500 |
| commit | 99cc7352156c65201c675f750e0e77c4c73d93f5 (patch) | |
| tree | 59cf50458a58b7499133b1fbae719d1931929588 /drivers/pinctrl | |
| parent | eccf17c0a8017cfe594f498141980b81877e2246 (diff) | |
| download | linux-99cc7352156c65201c675f750e0e77c4c73d93f5.tar.gz linux-99cc7352156c65201c675f750e0e77c4c73d93f5.tar.bz2 linux-99cc7352156c65201c675f750e0e77c4c73d93f5.zip | |
pinctrl: single: fix refcount leak in pcs_add_gpio_func()
[ Upstream commit 353353309b0f7afa407df29e455f9d15b5acc296 ]
of_parse_phandle_with_args() returns a device_node pointer with refcount
incremented in gpiospec.np. The loop iterates through all phandles but
never releases the reference, causing a refcount leak on each iteration.
Add of_node_put() calls to release the reference after extracting the
needed arguments and on the error path when devm_kzalloc() fails.
This bug was detected by our static analysis tool and verified by my
code review.
Fixes: a1a277eb76b3 ("pinctrl: single: create new gpio function range")
Signed-off-by: Wei Li <unsw.weili@gmail.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/pinctrl')
| -rw-r--r-- | drivers/pinctrl/pinctrl-single.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c index 2ee0ee3b6ed1..4aadafe2c50a 100644 --- a/drivers/pinctrl/pinctrl-single.c +++ b/drivers/pinctrl/pinctrl-single.c @@ -1363,6 +1363,7 @@ static int pcs_add_gpio_func(struct device_node *node, struct pcs_device *pcs) } range = devm_kzalloc(pcs->dev, sizeof(*range), GFP_KERNEL); if (!range) { + of_node_put(gpiospec.np); ret = -ENOMEM; break; } @@ -1372,6 +1373,7 @@ static int pcs_add_gpio_func(struct device_node *node, struct pcs_device *pcs) mutex_lock(&pcs->mutex); list_add_tail(&range->node, &pcs->gpiofuncs); mutex_unlock(&pcs->mutex); + of_node_put(gpiospec.np); } return ret; } |