[v1] regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

[PATCH] regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

Posted by Wentao Liang 1 week, 5 days ago

scmi_regulator_probe() calls of_find_node_by_name() which takes a
reference on the returned device node. On the error path where
process_scmi_regulator_of_node() fails, the function returns without
calling of_node_put() on the child node, leaking the reference.

Add of_node_put(np) on the error path to properly release the
reference.

Cc: stable@vger.kernel.org
Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/regulator/scmi-regulator.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
index 6d609c42e479..f1fe20b0fd76 100644
--- a/drivers/regulator/scmi-regulator.c
+++ b/drivers/regulator/scmi-regulator.c
@@ -345,8 +345,10 @@ static int scmi_regulator_probe(struct scmi_device *sdev)
 	for_each_child_of_node_scoped(np, child) {
 		ret = process_scmi_regulator_of_node(sdev, ph, child, rinfo);
 		/* abort on any mem issue */
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			rof_node_put(np);
 			return ret;
+		}
 	}
 	of_node_put(np);
 	/*
-- 
2.34.1

Re: [PATCH] regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

Posted by Cristian Marussi 1 week, 5 days ago

On Wed, May 27, 2026 at 09:25:21AM +0000, Wentao Liang wrote:
> scmi_regulator_probe() calls of_find_node_by_name() which takes a
> reference on the returned device node. On the error path where
> process_scmi_regulator_of_node() fails, the function returns without
> calling of_node_put() on the child node, leaking the reference.
> 

Hi,

I have NOT really reviewed the need for of_node_put...BUT...

> Add of_node_put(np) on the error path to properly release the
> reference.
> 
> Cc: stable@vger.kernel.org
> Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/regulator/scmi-regulator.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
> index 6d609c42e479..f1fe20b0fd76 100644
> --- a/drivers/regulator/scmi-regulator.c
> +++ b/drivers/regulator/scmi-regulator.c
> @@ -345,8 +345,10 @@ static int scmi_regulator_probe(struct scmi_device *sdev)
>  	for_each_child_of_node_scoped(np, child) {
>  		ret = process_scmi_regulator_of_node(sdev, ph, child, rinfo);
>  		/* abort on any mem issue */
> -		if (ret == -ENOMEM)
> +		if (ret == -ENOMEM) {
> +			rof_node_put(np);
		        ^....

...but you clearly not built this... 

Thanks,
Cristian