From nobody Mon Jun 8 18:57:56 2026 Received: from cstnet.cn (smtp25.cstnet.cn [159.226.251.25]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E9C913E7150; Wed, 27 May 2026 09:25:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.25 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779873950; cv=none; b=LjQ07iz8Kd8SP5uZyv6wRFQFnaokv4oT2A/qhkM5wz6rysPOVyc0Kea9IBU7PCJyCzhfOqPvx6NrKYdco/RKRX47m05waayOdOi2uA6bn5qs7N4Ik/16ny/i49RFQwfXrMNzV1Sm27R2uA/9Yguw3dqdi+R467jeJNBAWQrltQk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779873950; c=relaxed/simple; bh=yr4NZa71Dj7SF+YKpNwU3o2ezBWgDwVj4/13xaglh7s=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=kqVvXIFcGxgJABPQmDRnVaEvYfN/4tOL1c45ylFclLeYkl45wvF2635Sq7cET4OFgw3yH49u4ngigPP/YQ5SZ2hSxYwDsd2YOuFJyDUMUEhOA18FevNHKw6c9KWauKzCWzb6FwfD61DeFBIKi/IViC+NyCt34du6RoHCiMTJz5A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from dfae2b116770.home.arpa (unknown [36.110.52.3]) by APP-05 (Coremail) with SMTP id zQCowAC3F9uPuBZqxN6KEQ--.1418S2; Wed, 27 May 2026 17:25:36 +0800 (CST) From: Wentao Liang To: Sudeep Holla , Liam Girdwood , Mark Brown Cc: Cristian Marussi , arm-scmi@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Wentao Liang , stable@vger.kernel.org Subject: [PATCH] regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() Date: Wed, 27 May 2026 09:25:21 +0000 Message-Id: <20260527092521.866310-1-vulab@iscas.ac.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zQCowAC3F9uPuBZqxN6KEQ--.1418S2 X-Coremail-Antispam: 1UD129KBjvdXoW7GryrZF47Xr18Cw1UAw1UJrb_yoWkZFc_Gr yfW3W7JrWDur48Wrn7XFZ0vr9xKr1qgayxZF4IkFW3Cw1Yv3WDJa43Xr9xArW8Z3y8Jr9r WwsrArW8Aw43ujkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUIcSsGvfJTRUUUbcAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k26cxKx2IYs7xG 6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8w A2z4x0Y4vE2Ix0cI8IcVAFwI0_Xr0_Ar1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_ Cr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_GcCE3s 1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E2Ix0 cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r4j6F4UMcvjeVCFs4IE7xkEbVWUJVW8Jw ACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lc7CjxVAaw2AFwI0_Jw0_ GFyl42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxV WUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r1q6r43MIIYrxkI 7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r 1j6r4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67AKxVWUJVW8JwCI 42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvjfU52NtDUUUU X-CM-SenderInfo: pyxotu46lvutnvoduhdfq/1tbiDAcAA2oWidms9QABs8 Content-Type: text/plain; charset="utf-8" scmi_regulator_probe() calls of_find_node_by_name() which takes a reference on the returned device node. On the error path where process_scmi_regulator_of_node() fails, the function returns without calling of_node_put() on the child node, leaking the reference. Add of_node_put(np) on the error path to properly release the reference. Cc: stable@vger.kernel.org Fixes: 0fbeae70ee7c ("regulator: add SCMI driver") Signed-off-by: Wentao Liang --- drivers/regulator/scmi-regulator.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-re= gulator.c index 6d609c42e479..f1fe20b0fd76 100644 --- a/drivers/regulator/scmi-regulator.c +++ b/drivers/regulator/scmi-regulator.c @@ -345,8 +345,10 @@ static int scmi_regulator_probe(struct scmi_device *sd= ev) for_each_child_of_node_scoped(np, child) { ret =3D process_scmi_regulator_of_node(sdev, ph, child, rinfo); /* abort on any mem issue */ - if (ret =3D=3D -ENOMEM) + if (ret =3D=3D -ENOMEM) { + rof_node_put(np); return ret; + } } of_node_put(np); /* --=20 2.34.1