ptn5150_i2c_probe() looks up the "connector" child node with
device_get_named_child_node(), but never releases the reference that
the lookup returns.

fwnode_typec_switch_get() and fwnode_usb_role_switch_get() each take
their own reference on the switch they hand back, so the caller still
owns the fwnode reference.  Nothing in the driver drops it: the devm
cleanup handler ptn5150_work_sync_and_put() releases info->role_sw and
info->orient_sw only.  The node is therefore leaked on both error
returns that follow the lookup, and on a fully successful probe.

Declare 'connector' with __free(fwnode_handle) so that the reference is
released on every path out of the function.

Fixes: 842546c56345 ("extcon: ptn5150: Add Type-C orientation switch support")
Signed-off-by: Miles Krause <mileskrause5200@gmail.com>
---
 drivers/extcon/extcon-ptn5150.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/extcon/extcon-ptn5150.c b/drivers/extcon/extcon-ptn5150.c
index eca1b140aeb0..ede38eec2466 100644
--- a/drivers/extcon/extcon-ptn5150.c
+++ b/drivers/extcon/extcon-ptn5150.c
@@ -256,7 +256,6 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c)
 {
 	struct device *dev = &i2c->dev;
 	struct device_node *np = i2c->dev.of_node;
-	struct fwnode_handle *connector;
 	struct ptn5150_info *info;
 	int ret;
 
@@ -343,7 +342,8 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c)
 	if (ret)
 		return -EINVAL;
 
-	connector = device_get_named_child_node(dev, "connector");
+	struct fwnode_handle *connector __free(fwnode_handle) =
+		device_get_named_child_node(dev, "connector");
 	if (connector) {
 		info->orient_sw = fwnode_typec_switch_get(connector);
 		if (IS_ERR(info->orient_sw))

---
base-commit: 88405f0ad1d5c680afe3ea0ce9345fa9e1deaac8
change-id: 20260906-extcon-ptn5150-fwnode-leak-81c395149a9d

Best regards,
-- 
Miles Krause <mileskrause5200@gmail.com>

On Sun, Sep 06, 2026 at 03:49:24PM -0400, Miles Krause wrote:
> ptn5150_i2c_probe() looks up the "connector" child node with
> device_get_named_child_node(), but never releases the reference that
> the lookup returns.
> 
> fwnode_typec_switch_get() and fwnode_usb_role_switch_get() each take
> their own reference on the switch they hand back, so the caller still
> owns the fwnode reference.  Nothing in the driver drops it: the devm
> cleanup handler ptn5150_work_sync_and_put() releases info->role_sw and
> info->orient_sw only.  The node is therefore leaked on both error
> returns that follow the lookup, and on a fully successful probe.
> 
> Declare 'connector' with __free(fwnode_handle) so that the reference is
> released on every path out of the function.
> 
> Fixes: 842546c56345 ("extcon: ptn5150: Add Type-C orientation switch support")
> Signed-off-by: Miles Krause <mileskrause5200@gmail.com>

Reviewed-by: Xu Yang <xu.yang_2@nxp.com>

> ---
>  drivers/extcon/extcon-ptn5150.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/extcon/extcon-ptn5150.c b/drivers/extcon/extcon-ptn5150.c
> index eca1b140aeb0..ede38eec2466 100644
> --- a/drivers/extcon/extcon-ptn5150.c
> +++ b/drivers/extcon/extcon-ptn5150.c
> @@ -256,7 +256,6 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c)
>  {
>  	struct device *dev = &i2c->dev;
>  	struct device_node *np = i2c->dev.of_node;
> -	struct fwnode_handle *connector;
>  	struct ptn5150_info *info;
>  	int ret;
>  
> @@ -343,7 +342,8 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c)
>  	if (ret)
>  		return -EINVAL;
>  
> -	connector = device_get_named_child_node(dev, "connector");
> +	struct fwnode_handle *connector __free(fwnode_handle) =
> +		device_get_named_child_node(dev, "connector");
>  	if (connector) {
>  		info->orient_sw = fwnode_typec_switch_get(connector);
>  		if (IS_ERR(info->orient_sw))
> 
> ---
> base-commit: 88405f0ad1d5c680afe3ea0ce9345fa9e1deaac8
> change-id: 20260906-extcon-ptn5150-fwnode-leak-81c395149a9d
> 
> Best regards,
> -- 
> Miles Krause <mileskrause5200@gmail.com>
>