of_get_child_by_name() returns a node with an elevated reference count.
nvmem_add_one_cell() only takes ownership of that reference on success,
so the caller must drop it when the call fails. Add the missing
of_node_put() before returning so that info.np is not leaked.

Fixes: d9fae023fe86 ("nvmem: layouts: sl28vpd: Add new layout driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/nvmem/layouts/sl28vpd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/nvmem/layouts/sl28vpd.c b/drivers/nvmem/layouts/sl28vpd.c
index e93b020b0836..79de1e6947d0 100644
--- a/drivers/nvmem/layouts/sl28vpd.c
+++ b/drivers/nvmem/layouts/sl28vpd.c
@@ -126,6 +126,7 @@ static int sl28vpd_add_cells(struct nvmem_layout *layout)
 
 		ret = nvmem_add_one_cell(nvmem, &info);
 		if (ret) {
+			of_node_put(info.np);
 			of_node_put(layout_np);
 			return ret;
 		}
-- 
2.34.1

On Thu Sep 17, 2026 at 2:37 PM CEST, Wentao Liang wrote:
> of_get_child_by_name() returns a node with an elevated reference count.
> nvmem_add_one_cell() only takes ownership of that reference on success,
> so the caller must drop it when the call fails. Add the missing
> of_node_put() before returning so that info.np is not leaked.
>
> Fixes: d9fae023fe86 ("nvmem: layouts: sl28vpd: Add new layout driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

There was already a patch fixing this:

https://lore.kernel.org/r/tencent_65156571568C9E4076E52D1825CC5F476A08@qq.com/

-michael