]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
hwmon: (emc2305) fix device node refcount leak in error path
authorPei Xiao <xiaopei01@kylinos.cn>
Fri, 5 Dec 2025 03:15:13 +0000 (11:15 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 2 Jan 2026 11:57:03 +0000 (12:57 +0100)
[ Upstream commit 4910da6b36b122db50a27fabf6ab7f8611b60bf8 ]

The for_each_child_of_node() macro automatically manages device node
reference counts during normal iteration. However, when breaking out
of the loop early with return, the current iteration's node is not
automatically released, leading to a reference count leak.

Fix this by adding of_node_put(child) before returning from the loop
when emc2305_set_single_tz() fails.

This issue could lead to memory leaks over multiple probe cycles.

Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Link: https://lore.kernel.org/r/tencent_5CDC08544C901D5ECA270573D5AEE3117108@qq.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/hwmon/emc2305.c

index 60809289f8169d685a98305fa017339f69ac97d3..84cb9b72cb6c2b153dcf8743dd8978eb0a9b5c0a 100644 (file)
@@ -685,8 +685,10 @@ static int emc2305_probe(struct i2c_client *client)
                        i = 0;
                        for_each_child_of_node(dev->of_node, child) {
                                ret = emc2305_set_single_tz(dev, child, i);
-                               if (ret != 0)
+                               if (ret != 0) {
+                                       of_node_put(child);
                                        return ret;
+                               }
                                i++;
                        }
                } else {