diff options
| author | Krzysztof Kozlowski <krzk@kernel.org> | 2019-08-05 18:27:10 +0200 |
|---|---|---|
| committer | Krzysztof Kozlowski <krzk@kernel.org> | 2019-10-01 20:22:04 +0200 |
| commit | a322b3377f4bac32aa25fb1acb9e7afbbbbd0137 (patch) | |
| tree | 1489eb80b91f2b0f672e6e924d34271216de2ab2 /drivers | |
| parent | 7f028caadf6c37580d0f59c6c094ed09afc04062 (diff) | |
| download | linux-a322b3377f4bac32aa25fb1acb9e7afbbbbd0137.tar.bz2 | |
pinctrl: samsung: Fix device node refcount leaks in init code
Several functions use for_each_child_of_node() loop with a break to find
a matching child node. Although each iteration of
for_each_child_of_node puts the previous node, but early exit from loop
misses it. This leads to leak of device node.
Cc: <stable@vger.kernel.org>
Fixes: 9a2c1c3b91aa ("pinctrl: samsung: Allow grouping multiple pinmux/pinconf nodes")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/pinctrl/samsung/pinctrl-samsung.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c index de0477bb469d..f26574ef234a 100644 --- a/drivers/pinctrl/samsung/pinctrl-samsung.c +++ b/drivers/pinctrl/samsung/pinctrl-samsung.c @@ -272,6 +272,7 @@ static int samsung_dt_node_to_map(struct pinctrl_dev *pctldev, &reserved_maps, num_maps); if (ret < 0) { samsung_dt_free_map(pctldev, *map, *num_maps); + of_node_put(np); return ret; } } @@ -785,8 +786,10 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions( if (!of_get_child_count(cfg_np)) { ret = samsung_pinctrl_create_function(dev, drvdata, cfg_np, func); - if (ret < 0) + if (ret < 0) { + of_node_put(cfg_np); return ERR_PTR(ret); + } if (ret > 0) { ++func; ++func_cnt; @@ -797,8 +800,11 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions( for_each_child_of_node(cfg_np, func_np) { ret = samsung_pinctrl_create_function(dev, drvdata, func_np, func); - if (ret < 0) + if (ret < 0) { + of_node_put(func_np); + of_node_put(cfg_np); return ERR_PTR(ret); + } if (ret > 0) { ++func; ++func_cnt; |