If the call to fsi_master_register() fails, the function exits
without releasing the of_node reference previously acquired via
of_node_get(). This results in an of_node reference count leak.

Add a call to of_node_put() under a new label to ensure the
reference is correctly released before the function returns.

Fixes: f6a2f8eb73f0 ("fsi: Match fsi slaves and engines to available dt nodes")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/fsi/fsi-master-hub.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/fsi/fsi-master-hub.c b/drivers/fsi/fsi-master-hub.c
index 6568fed7db3c..e259ed1c17e0 100644
--- a/drivers/fsi/fsi-master-hub.c
+++ b/drivers/fsi/fsi-master-hub.c
@@ -241,7 +241,7 @@ static int hub_master_probe(struct device *dev)
 
 	rc = fsi_master_register(&hub->master);
 	if (rc)
-		goto err_release;
+		goto err_free_node;
 
 	/* At this point, fsi_master_register performs the device_initialize(),
 	 * and holds the sole reference on master.dev. This means the device
@@ -253,6 +253,8 @@ static int hub_master_probe(struct device *dev)
 	get_device(&hub->master.dev);
 	return 0;
 
+err_free_node:
+	of_node_put(hub->master.dev.of_node);
 err_release:
 	fsi_slave_release_range(fsi_dev->slave, FSI_HUB_LINK_OFFSET,
 			FSI_HUB_LINK_SIZE * links);
-- 
2.50.1.windows.1

On 10/30/25 4:55 AM, Haotian Zhang wrote:
> If the call to fsi_master_register() fails, the function exits
> without releasing the of_node reference previously acquired via
> of_node_get(). This results in an of_node reference count leak.
>
> Add a call to of_node_put() under a new label to ensure the
> reference is correctly released before the function returns.


Reviewed-by: Eddie James <eajames@linux.ibm.com>


>
> Fixes: f6a2f8eb73f0 ("fsi: Match fsi slaves and engines to available dt nodes")
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
> ---
>   drivers/fsi/fsi-master-hub.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/fsi/fsi-master-hub.c b/drivers/fsi/fsi-master-hub.c
> index 6568fed7db3c..e259ed1c17e0 100644
> --- a/drivers/fsi/fsi-master-hub.c
> +++ b/drivers/fsi/fsi-master-hub.c
> @@ -241,7 +241,7 @@ static int hub_master_probe(struct device *dev)
>   
>   	rc = fsi_master_register(&hub->master);
>   	if (rc)
> -		goto err_release;
> +		goto err_free_node;
>   
>   	/* At this point, fsi_master_register performs the device_initialize(),
>   	 * and holds the sole reference on master.dev. This means the device
> @@ -253,6 +253,8 @@ static int hub_master_probe(struct device *dev)
>   	get_device(&hub->master.dev);
>   	return 0;
>   
> +err_free_node:
> +	of_node_put(hub->master.dev.of_node);
>   err_release:
>   	fsi_slave_release_range(fsi_dev->slave, FSI_HUB_LINK_OFFSET,
>   			FSI_HUB_LINK_SIZE * links);