pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()

[PATCH v2] pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()

Posted by Haotian Zhang 3 months, 1 week ago

The driver calls fwnode_get_named_child_node() which takes a reference
on the child node, but never releases it, which causes a reference leak.

Fix by using devm_add_action_or_reset() to automatically release the
reference when the device is removed.

Fixes: d5282a539297 ("pinctrl: cs42l43: Add support for the cs42l43")
Suggested-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
Changes in v2:
  - Use devm_add_action_or_reset() instead of manual put in success path
    to properly manage fwnode lifetime throughout device lifecycle
    (suggested by Charles Keepax)
---
 drivers/pinctrl/cirrus/pinctrl-cs42l43.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/drivers/pinctrl/cirrus/pinctrl-cs42l43.c b/drivers/pinctrl/cirrus/pinctrl-cs42l43.c
index 68abb6d6cecd..a8f82104a384 100644
--- a/drivers/pinctrl/cirrus/pinctrl-cs42l43.c
+++ b/drivers/pinctrl/cirrus/pinctrl-cs42l43.c
@@ -532,6 +532,11 @@ static int cs42l43_gpio_add_pin_ranges(struct gpio_chip *chip)
 	return ret;
 }
 
+static void cs42l43_fwnode_put(void *data)
+{
+	fwnode_handle_put(data);
+}
+
 static int cs42l43_pin_probe(struct platform_device *pdev)
 {
 	struct cs42l43 *cs42l43 = dev_get_drvdata(pdev->dev.parent);
@@ -563,10 +568,20 @@ static int cs42l43_pin_probe(struct platform_device *pdev)
 	priv->gpio_chip.ngpio = CS42L43_NUM_GPIOS;
 
 	if (is_of_node(fwnode)) {
-		fwnode = fwnode_get_named_child_node(fwnode, "pinctrl");
-
-		if (fwnode && !fwnode->dev)
-			fwnode->dev = priv->dev;
+		struct fwnode_handle *child;
+
+		child = fwnode_get_named_child_node(fwnode, "pinctrl");
+		if (child) {
+			ret = devm_add_action_or_reset(&pdev->dev,
+				cs42l43_fwnode_put, child);
+			if (ret) {
+				fwnode_handle_put(child);
+				return ret;
+			}
+			if (!child->dev)
+				child->dev = priv->dev;
+			fwnode = child;
+		}
 	}
 
 	priv->gpio_chip.fwnode = fwnode;
-- 
2.50.1.windows.1

Re: [PATCH v2] pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()

Posted by Linus Walleij 2 months, 4 weeks ago

On Tue, Oct 28, 2025 at 4:06 AM Haotian Zhang <vulab@iscas.ac.cn> wrote:

> The driver calls fwnode_get_named_child_node() which takes a reference
> on the child node, but never releases it, which causes a reference leak.
>
> Fix by using devm_add_action_or_reset() to automatically release the
> reference when the device is removed.
>
> Fixes: d5282a539297 ("pinctrl: cs42l43: Add support for the cs42l43")
> Suggested-by: Charles Keepax <ckeepax@opensource.cirrus.com>
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>

Patch applied.

Yours,
Linus Walleij

Re: [PATCH v2] pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()

Posted by Markus Elfring 3 months, 1 week ago

…
> +++ b/drivers/pinctrl/cirrus/pinctrl-cs42l43.c
…
> @@ -563,10 +568,20 @@ static int cs42l43_pin_probe(struct platform_device *pdev)
>  	priv->gpio_chip.ngpio = CS42L43_NUM_GPIOS;
>  
>  	if (is_of_node(fwnode)) {
…
> +		child = fwnode_get_named_child_node(fwnode, "pinctrl");
> +		if (child) {
> +			ret = devm_add_action_or_reset(&pdev->dev,
> +				cs42l43_fwnode_put, child);
> +			if (ret) {
> +				fwnode_handle_put(child);
> +				return ret;
> +			}
…

I doubt that such a function call is needed in this if branch.
https://elixir.bootlin.com/linux/v6.18-rc3/source/include/linux/device/devres.h#L152-L168

Regards,
Markus