pinctrl: sunxi: Fix memory leak on krealloc failure

[ Upstream commit e3507c56cbb208d4f160942748c527ef6a528ba1 ]

In sunxi_pctrl_dt_node_to_map(), when krealloc() fails to resize
the pinctrl_map array, the function returns -ENOMEM directly
without freeing the previously allocated *map buffer. This results
in a memory leak of the original kmalloc_array allocation.

Fixes: e11dee2e98f8 ("pinctrl: sunxi: Deal with configless pins")
Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
Link: https://lore.kernel.org/20250620012708.16709-1-chenyuan_fl@163.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 6c04027d0dd9775310a5c7c352d1d287c9b1e2d6..df2e721297fc9dac497c26be9c8de3ef9945089f 100644 (file)
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -396,6 +396,7 @@ static int sunxi_pctrl_dt_node_to_map(struct pinctrl_dev *pctldev,
        const char *function, *pin_prop;
        const char *group;
        int ret, npins, nmaps, configlen = 0, i = 0;
+       struct pinctrl_map *new_map;
 
        *map = NULL;
        *num_maps = 0;
@@ -470,9 +471,13 @@ static int sunxi_pctrl_dt_node_to_map(struct pinctrl_dev *pctldev,
         * We know have the number of maps we need, we can resize our
         * map array
         */
-       *map = krealloc(*map, i * sizeof(struct pinctrl_map), GFP_KERNEL);
-       if (!*map)
-               return -ENOMEM;
+       new_map = krealloc(*map, i * sizeof(struct pinctrl_map), GFP_KERNEL);
+       if (!new_map) {
+               ret = -ENOMEM;
+               goto err_free_map;
+       }
+
+       *map = new_map;
 
        return 0;