From nobody Sat Feb 7 17:48:37 2026 Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C2AA2EBB86 for ; Fri, 23 Jan 2026 03:56:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769140627; cv=none; b=uQDSpJQPO0e3DvkRrTwPfUP4MI5xGlImrGavL6/cj0U1gLvIF2AbcVM8YJeeJpTCaXrsg3Dek0DpdXFrQC5O0MAdZC5BRS6MvJIXUuD3+MFUEy4EN9plO3iYmTexiCHXbsH9zTPM6/YKRSF2urmuXjuHRrarNg7hedIDLeVALrA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769140627; c=relaxed/simple; bh=9IkWk7ZurIDOgZSoVU/ErgeaZNfgE62rKwgWKZ2gMQ8=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=nHArrjj5/hLFeu75z2q9t7n2ZjEAvxT21dZt2ecriTZWdW+0w/GGTviLR6Ew9G9OvKLOzT/QdKwrknCoEqZdTo6gCuWbvC7c7GhsjsSWfBVONTLHtXmW5+mX+F4dLY5QM+2DYTHwajtZG9NlrPa807XUwcw2idgp7GyBsPoazMQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mEg3H/Jc; arc=none smtp.client-ip=209.85.210.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mEg3H/Jc" Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-8220bd582ddso861661b3a.2 for ; Thu, 22 Jan 2026 19:56:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1769140614; x=1769745414; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=/otCFW7jCkMsv16Qri9tIeY6tMlxQmHzjcpDQaISHXM=; b=mEg3H/JcpB2yRs/VHxZ3ql0sAoabUgJquZJuCf/z1MMO8bPHUyU9q8DX3D+cyxZ9/6 axp1Gc8OOCROeyZonK7U5+02RcKE3yBLMUyN0wRCQJpjX2RHThagPj3qGjys5psPrCyz 9e2qGzihv8KUvUJaMEOyMqIoNZcNrwa3k0t1JMMyfrKcoHylv89USD2V42mCyPWjHwtg HEzIYYjJrI3ge1b4zTKdxTqe8ZhzvlEjO1Mllcv6bvsZprz+/IhAEMXq5+drZSuydlrp w7FBqG/lgNbMOesAZbofEAOhPVA1sk5PwsZvbmz+NevO3w1qGwai1lu2yxjc4ElwK5e3 I9TQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769140614; x=1769745414; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=/otCFW7jCkMsv16Qri9tIeY6tMlxQmHzjcpDQaISHXM=; b=oOHBhP1LBeXLqebNJ/iZSR2ksK5unxljSKXWt7WBOyA05gbgGO8NvcIfWWors3g3sa yj6eoG7q/u7jZ2ZCMVDk0oBZwWYWFy+kEIuGsqi9aWuewUhyBV+9Cgcat0Y2OIi0RrrI dd84m3NzyNAX+M3rVrGV8K31HshpthsB2yB7AM0PPigrBPOtdUzpsprDq1JEt6iVwpE1 nHtl+bbxNf6dqJTF1EXUwr18Ctf3Nf5NwwcGi+Ieurw3VcqhTQiD5rIayJgQKkVt/llQ euv9LMl8Lc6W1YyeC0KgmAH5awbWlzQa6DsrFaBRj2PyDSQZyLixsEu11m9r9YPF6bI8 a6rw== X-Forwarded-Encrypted: i=1; AJvYcCXVRNvgfIxtV7hgix44HPLaqXNYvLIHgp19ZURcf6fw5ogsbkcmHQbYeo1Fe1BxSTmOcCP67cvGr4YHYws=@vger.kernel.org X-Gm-Message-State: AOJu0Yzlmpm2T7spa92ugW1DTcqS7/V0XrMOhbMaFLWDoCI/67tq5NwZ eZt2aiq4tP/gAFf0sBhb+SQNDp4UTeyCzsXhbIWuJSJ00cOCjprNn3bm X-Gm-Gg: AZuq6aL0IQlrlR2Ffh1AolywQzBdPsAfaWWfjlQJooK9vfo5hgyjtYRur92BqTV9Nz3 WcLJjuNbN0AY7ftPXeH9E+KGqY9WEG/U94UZ8d7fN238/ApjiETKBEO1Uo+R/3k1aDe8eCJxhYx 8qfrwrA6p7nYVSqXkTZSyAPBAxiVvvzBCWszzEwwSsD9fe8chJB0/zJ8o22jYR+98uA7ILpYu52 bJEpzj5UGCTS4xMiBJ8piWTVUAm6UmfOpPfTT2qf2md1fzgaqWuUhPDW3YFsLRcKLsr2HIV0rT4 hhDle+PbUibYv0KGL6fgEw9eXcMmk187ZqjwM9vZ1mdmwX5BzpOH5yI9LiC1e7BjGOOR6T3dtam 7EMqfl9n2UxESJMcGd9lXaAQ0H4Jb4xFcwZd+/nuuCnJUh2FUQHiisSdvh6YKct7SGsDjAVxy4l SIoRXjzBn7pmfUlJo5hLeo1qaOYT8v5tAI+j6n+9JblAEbGv631t7buWoqvlnyov0VVpVOImHtb 0bMmyL4vnqiMeWobFukY3hMpTm5ChTxqjVC4KYYULvVCSs= X-Received: by 2002:a05:6a21:69a:b0:35e:e604:f766 with SMTP id adf61e73a8af0-38e6f6a9658mr1638303637.6.1769140614130; Thu, 22 Jan 2026 19:56:54 -0800 (PST) Received: from c8971f1abf06.ap-southeast-2.compute.internal (ec2-54-252-206-51.ap-southeast-2.compute.amazonaws.com. [54.252.206.51]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c635a424485sm688045a12.27.2026.01.22.19.56.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 22 Jan 2026 19:56:53 -0800 (PST) From: Weigang He To: jassisinghbrar@gmail.com, s-anna@ti.com Cc: tony@atomide.com, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Weigang He Subject: [PATCH] mailbox: omap: fix reference count leak in omap_mbox_probe() Date: Fri, 23 Jan 2026 03:56:48 +0000 Message-Id: <20260123035648.1441763-1-geoffreyhe2@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" of_get_next_available_child() returns a device_node pointer with refcount incremented. The caller is responsible for calling of_node_put() to release the reference when done. In omap_mbox_probe(), when the loop iterates over child nodes using of_get_next_available_child(), several error paths return directly without releasing the child node reference. Additionally, when the loop completes normally, the last child node reference is never released. Fix this by: 1. Using goto-based error handling to ensure of_node_put(child) is called on all error paths within the loop 2. Adding of_node_put(child) after the loop completes normally to release the last child node reference Fixes: 75288cc66dc4 ("mailbox/omap: add support for parsing dt devices") Cc: stable@vger.kernel.org Signed-off-by: Weigang He --- drivers/mailbox/omap-mailbox.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/drivers/mailbox/omap-mailbox.c b/drivers/mailbox/omap-mailbox.c index 17fe6545875d0..3f6af947e29ce 100644 --- a/drivers/mailbox/omap-mailbox.c +++ b/drivers/mailbox/omap-mailbox.c @@ -508,14 +508,16 @@ static int omap_mbox_probe(struct platform_device *pd= ev) int rx_id, rx_usr; =20 mbox =3D devm_kzalloc(&pdev->dev, sizeof(*mbox), GFP_KERNEL); - if (!mbox) - return -ENOMEM; + if (!mbox) { + ret =3D -ENOMEM; + goto err_put_child; + } =20 child =3D of_get_next_available_child(node, child); ret =3D of_property_read_u32_array(child, "ti,mbox-tx", tmp, ARRAY_SIZE(tmp)); if (ret) - return ret; + goto err_put_child; tx_id =3D tmp[0]; tx_irq =3D tmp[1]; tx_usr =3D tmp[2]; @@ -523,14 +525,16 @@ static int omap_mbox_probe(struct platform_device *pd= ev) ret =3D of_property_read_u32_array(child, "ti,mbox-rx", tmp, ARRAY_SIZE(tmp)); if (ret) - return ret; + goto err_put_child; rx_id =3D tmp[0]; /* rx_irq =3D tmp[1]; */ rx_usr =3D tmp[2]; =20 if (tx_id >=3D num_fifos || rx_id >=3D num_fifos || - tx_usr >=3D num_users || rx_usr >=3D num_users) - return -EINVAL; + tx_usr >=3D num_users || rx_usr >=3D num_users) { + ret =3D -EINVAL; + goto err_put_child; + } =20 fifo =3D &mbox->tx_fifo; fifo->msg =3D MAILBOX_MESSAGE(tx_id); @@ -554,11 +558,14 @@ static int omap_mbox_probe(struct platform_device *pd= ev) mbox->parent =3D mdev; mbox->name =3D child->name; mbox->irq =3D platform_get_irq(pdev, tx_irq); - if (mbox->irq < 0) - return mbox->irq; + if (mbox->irq < 0) { + ret =3D mbox->irq; + goto err_put_child; + } mbox->chan =3D &chnls[i]; chnls[i].con_priv =3D mbox; } + of_node_put(child); =20 mutex_init(&mdev->cfg_lock); mdev->dev =3D &pdev->dev; @@ -602,6 +609,10 @@ static int omap_mbox_probe(struct platform_device *pde= v) return ret; =20 return 0; + +err_put_child: + of_node_put(child); + return ret; } =20 static struct platform_driver omap_mbox_driver =3D { --=20 2.34.1