From 54c66b5e47a9b10cbf4a1efe9b01301b7ffee205 Mon Sep 17 00:00:00 2001 From: Ma Ke Date: Sun, 11 Oct 2026 14:17:22 +0800 Subject: [PATCH] pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank() stm32_gpiolib_register_bank() walks the "gpio-ranges" property with fwnode_property_get_reference_args(). As documented in drivers/base/property.c: * The caller is responsible for calling fwnode_handle_put() on the * returned @args->fwnode pointer. The returned reference is never put. The function calls the helper twice, once directly and then repeatedly in a while loop, and each call overwrites args, so only the last reference is even reachable and all the earlier ones are leaked for good. Put the reference as soon as args.args[] has been consumed, both for the initial call and for every iteration of the loop. Found by code review. Cc: stable@vger.kernel.org Fixes: bb949ed9b16b ("pinctrl: stm32: Switch to use for_each_gpiochip_node() helper") Signed-off-by: Ma Ke Reviewed-by: Antonio Borneo Signed-off-by: Linus Walleij --- drivers/pinctrl/stm32/pinctrl-stm32.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c index 587dbf1512dc..6ebb8ea260d1 100644 --- a/drivers/pinctrl/stm32/pinctrl-stm32.c +++ b/drivers/pinctrl/stm32/pinctrl-stm32.c @@ -1666,8 +1666,12 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode /* get the last defined gpio line (offset + nb of pins) */ npins = args.args[0] + args.args[2]; - while (!fwnode_property_get_reference_args(fwnode, "gpio-ranges", NULL, 3, ++i, &args)) + fwnode_handle_put(args.fwnode); + + while (!fwnode_property_get_reference_args(fwnode, "gpio-ranges", NULL, 3, ++i, &args)) { npins = max(npins, (int)(args.args[0] + args.args[2])); + fwnode_handle_put(args.fwnode); + } } else { bank_nr = pctl->nbanks; bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK;