mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()

of_get_child_by_name() returns a node pointer with refcount incremented,
which must be released with of_node_put() when done. However, in
parse_fixed_partitions(), when dedicated is true (i.e., a "partitions"
subnode was found), the ofpart_node obtained from of_get_child_by_name()
is never released on any code path.

Add of_node_put(ofpart_node) calls on all exit paths when dedicated is
true to fix the reference count leak.

This bug was detected by our static analysis tool.

Fixes: 562b4e91d3b2 ("mtd: parsers: ofpart: fix parsing subpartitions")
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>

diff --git a/drivers/mtd/parsers/ofpart_core.c b/drivers/mtd/parsers/ofpart_core.c
index e04eee028f63c5f450f0fe9c891e344941f9cc94..599adb69eba63287c929bfff850e5bc187c6c536 100644 (file)
--- a/drivers/mtd/parsers/ofpart_core.c
+++ b/drivers/mtd/parsers/ofpart_core.c
@@ -81,6 +81,7 @@ static int parse_fixed_partitions(struct mtd_info *master,
        of_id = of_match_node(parse_ofpart_match_table, ofpart_node);
        if (dedicated && !of_id) {
                /* The 'partitions' subnode might be used by another parser */
+               of_node_put(ofpart_node);
                return 0;
        }
 
@@ -95,12 +96,18 @@ static int parse_fixed_partitions(struct mtd_info *master,
                nr_parts++;
        }
 
-       if (nr_parts == 0)
+       if (nr_parts == 0) {
+               if (dedicated)
+                       of_node_put(ofpart_node);
                return 0;
+       }
 
        parts = kcalloc(nr_parts, sizeof(*parts), GFP_KERNEL);
-       if (!parts)
+       if (!parts) {
+               if (dedicated)
+                       of_node_put(ofpart_node);
                return -ENOMEM;
+       }
 
        i = 0;
        for_each_child_of_node(ofpart_node,  pp) {
@@ -179,6 +186,9 @@ static int parse_fixed_partitions(struct mtd_info *master,
        if (quirks && quirks->post_parse)
                quirks->post_parse(master, parts, nr_parts);
 
+       if (dedicated)
+               of_node_put(ofpart_node);
+
        *pparts = parts;
        return nr_parts;
 
@@ -187,6 +197,8 @@ ofpart_fail:
               master->name, pp, mtd_node);
        ret = -EINVAL;
 ofpart_none:
+       if (dedicated)
+               of_node_put(ofpart_node);
        of_node_put(pp);
        kfree(parts);
        return ret;