__w1_attach_slave_device() stores the device node returned by
of_find_matching_node() in sl->dev.of_node, but nothing drops that
reference when the slave device is released: w1_slave_release() never
calls of_node_put() and the device core does not free dev->of_node
either.  The node reference taken on every successful slave
registration is therefore leaked.

Drop the reference in w1_slave_release() and remove the explicit
of_node_put() from the device_register() failure path, which now
releases the node through put_device().

Fixes: fae68031f7fb ("w1: core: match sub-nodes of bus masters in devicetree")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/w1/w1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index 486f321eadc8..909f0ac6eafe 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -78,6 +78,7 @@ static void w1_slave_release(struct device *dev)
 
 	dev_dbg(dev, "%s: Releasing %s [%p]\n", __func__, sl->name, sl);
 
+	of_node_put(dev->of_node);
 	w1_family_put(sl->family);
 	sl->master->slave_count--;
 }
@@ -692,7 +693,6 @@ static int __w1_attach_slave_device(struct w1_slave *sl)
 		dev_err(&sl->dev,
 			"Device registration [%s] failed. err=%d\n",
 			dev_name(&sl->dev), err);
-		of_node_put(sl->dev.of_node);
 		put_device(&sl->dev);
 		return err;
 	}
-- 
2.34.1