From: Stepan Ionichev Date: Thu, 14 May 2026 17:14:55 +0000 (+0500) Subject: device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=9582485a65eacfd7245ec7f0a9d7e2c34749d669;p=thirdparty%2Fkernel%2Flinux.git device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() When called with FWNODE_GRAPH_ENDPOINT_NEXT, the function walks every endpoint under the requested port and, for any endpoint whose ID is greater than or equal to the requested one, may store a fwnode reference in best_ep via fwnode_handle_get(). If a later iteration finds an exact-ID match, the function returns that endpoint directly without dropping the reference held by best_ep, leaking it. Drop the saved candidate before returning the exact-match endpoint. This affects callers that use FWNODE_GRAPH_ENDPOINT_NEXT to ask for the next endpoint with ID >= the requested one (used by a number of media drivers, e.g. imx7/8, sun6i CSI, omap3isp, xilinx-csi2, stm32-csi). Each leak retains a fwnode reference until reboot/unbind. Fixes: 0fcc2bdc8aff ("device property: Add fwnode_graph_get_endpoint_by_id()") Signed-off-by: Stepan Ionichev Link: https://patch.msgid.link/20260514171455.27271-1-sozdayvek@gmail.com Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/base/property.c b/drivers/base/property.c index 8e0148a37fffb..e08eadd66f4f9 100644 --- a/drivers/base/property.c +++ b/drivers/base/property.c @@ -1277,8 +1277,10 @@ fwnode_graph_get_endpoint_by_id(const struct fwnode_handle *fwnode, if (fwnode_ep.port != port) continue; - if (fwnode_ep.id == endpoint) + if (fwnode_ep.id == endpoint) { + fwnode_handle_put(best_ep); return ep; + } if (!endpoint_next) continue;