The function calls of_parse_phandle() to get a
device node, which increments the reference count of the node. However,
the function fails to call of_node_put() to decrement the reference.
This leads to a reference count leak.

This is found by static analysis and similar to the commit a508e33956b5
("ipmi:ipmb: Fix refcount leak in ipmi_ipmb_probe")

Fixes: 423de5b5bc5b ("thermal/of: Fix cdev lookup in thermal_of_should_bind()")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
---
 drivers/thermal/thermal_of.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c
index 1a51a4d240ff..932291648683 100644
--- a/drivers/thermal/thermal_of.c
+++ b/drivers/thermal/thermal_of.c
@@ -284,8 +284,12 @@ static bool thermal_of_cm_lookup(struct device_node *cm_np,
 		int count, i;
 
 		tr_np = of_parse_phandle(child, "trip", 0);
-		if (tr_np != trip->priv)
+		if (tr_np != trip->priv) {
+			of_node_put(tr_np);
 			continue;
+		}
+
+		of_node_put(tr_np);
 
 		/* The trip has been found, look up the cdev. */
 		count = of_count_phandle_with_args(child, "cooling-device",
-- 
2.39.5 (Apple Git-154)

On Sun, Oct 26, 2025 at 5:44 PM Miaoqian Lin <linmq006@gmail.com> wrote:
>
> The function calls of_parse_phandle() to get a
> device node, which increments the reference count of the node. However,
> the function fails to call of_node_put() to decrement the reference.
> This leads to a reference count leak.
>
> This is found by static analysis and similar to the commit a508e33956b5
> ("ipmi:ipmb: Fix refcount leak in ipmi_ipmb_probe")
>
> Fixes: 423de5b5bc5b ("thermal/of: Fix cdev lookup in thermal_of_should_bind()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
> ---
>  drivers/thermal/thermal_of.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c
> index 1a51a4d240ff..932291648683 100644
> --- a/drivers/thermal/thermal_of.c
> +++ b/drivers/thermal/thermal_of.c
> @@ -284,8 +284,12 @@ static bool thermal_of_cm_lookup(struct device_node *cm_np,
>                 int count, i;
>
>                 tr_np = of_parse_phandle(child, "trip", 0);
> -               if (tr_np != trip->priv)
> +               if (tr_np != trip->priv) {
> +                       of_node_put(tr_np);
>                         continue;
> +               }
> +
> +               of_node_put(tr_np);

If it can be done here, it may as well be done before the check above.

>
>                 /* The trip has been found, look up the cdev. */
>                 count = of_count_phandle_with_args(child, "cooling-device",
> --

It would be more prudent to hold this reference throughout the scope
though and release it when the scope is left.