pinctrl: single: fix refcount leak in pcs_add_gpio_func()

of_parse_phandle_with_args() returns a device_node pointer with refcount
incremented in gpiospec.np. The loop iterates through all phandles but
never releases the reference, causing a refcount leak on each iteration.

Add of_node_put() calls to release the reference after extracting the
needed arguments and on the error path when devm_kzalloc() fails.

This bug was detected by our static analysis tool and verified by my
code review.

Fixes: a1a277eb76b3 ("pinctrl: single: create new gpio function range")
Signed-off-by: Wei Li <unsw.weili@gmail.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>

diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 998f23d6c3179ec8a9c484a56eb1b49988ca592d..d85e6c1f632186b36e95b0b1338a7644ae751f99 100644 (file)
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1359,6 +1359,7 @@ static int pcs_add_gpio_func(struct device_node *node, struct pcs_device *pcs)
                }
                range = devm_kzalloc(pcs->dev, sizeof(*range), GFP_KERNEL);
                if (!range) {
+                       of_node_put(gpiospec.np);
                        ret = -ENOMEM;
                        break;
                }
@@ -1368,6 +1369,7 @@ static int pcs_add_gpio_func(struct device_node *node, struct pcs_device *pcs)
                mutex_lock(&pcs->mutex);
                list_add_tail(&range->node, &pcs->gpiofuncs);
                mutex_unlock(&pcs->mutex);
+               of_node_put(gpiospec.np);
        }
        return ret;
 }