queue-5.4/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch

   1 From 637c2303364d0a04cd86442947c6144bd9305f63 Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Mon, 15 Apr 2024 18:53:28 +0800
   4 Subject: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
   5
   6 From: Zeng Heng <zengheng4@huawei.com>
   7
   8 [ Upstream commit a0cedbcc8852d6c77b00634b81e41f17f29d9404 ]
   9
  10 If we fail to allocate propname buffer, we need to drop the reference
  11 count we just took. Because the pinctrl_dt_free_maps() includes the
  12 droping operation, here we call it directly.
  13
  14 Fixes: 91d5c5060ee2 ("pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map")
  15 Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
  16 Signed-off-by: Zeng Heng <zengheng4@huawei.com>
  17 Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
  18 Message-ID: <20240415105328.3651441-1-zengheng4@huawei.com>
  19 Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
  20 Signed-off-by: Sasha Levin <sashal@kernel.org>
  21 ---
  22  drivers/pinctrl/devicetree.c | 10 ++++++----
  23  1 file changed, 6 insertions(+), 4 deletions(-)
  24
  25 diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
  26 index 362d84c2ead44..200357094e3be 100644
  27 --- a/drivers/pinctrl/devicetree.c
  28 +++ b/drivers/pinctrl/devicetree.c
  29 @@ -223,14 +223,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev)
  30         for (state = 0; ; state++) {
  31                 /* Retrieve the pinctrl-* property */
  32                 propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state);
  33 -               if (!propname)
  34 -                       return -ENOMEM;
  35 +               if (!propname) {
  36 +                       ret = -ENOMEM;
  37 +                       goto err;
  38 +               }
  39                 prop = of_find_property(np, propname, &size);
  40                 kfree(propname);
  41                 if (!prop) {
  42                         if (state == 0) {
  43 -                               of_node_put(np);
  44 -                               return -ENODEV;
  45 +                               ret = -ENODEV;
  46 +                               goto err;
  47                         }
  48                         break;
  49                 }
  50 --
  51 2.43.0
  52