From 73bd84aa58ad1fd775d6af2e8445a9456659c445 Mon Sep 17 00:00:00 2001 From: Leo Cheng Date: Fri, 2 Oct 2026 11:13:27 +0100 Subject: [PATCH] nvmem: layouts: sl28vpd: fix device_node reference leak in error path sl28vpd_add_cells() takes a reference on the child node via of_get_child_by_name() for each entry and passes it to nvmem_add_one_cell() as info.np. On success the created cell entry adopts that reference and releases it later via of_node_put() when the entry is torn down; nvmem_add_one_cell() does not take its own reference. On failure it does not consume the reference either, so the caller still owns it, but the error path only puts layout_np before returning, leaking the child node reference. Put info.np on the error path as well. of_node_put(NULL) is a no-op, so this is safe even when of_get_child_by_name() returned NULL. Fixes: d9fae023fe86 ("nvmem: layouts: sl28vpd: Add new layout driver") Signed-off-by: Leo Cheng Reviewed-by: Michael Walle Reviewed-by: Miquel Raynal Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20261002101329.1084348-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/nvmem/layouts/sl28vpd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/nvmem/layouts/sl28vpd.c b/drivers/nvmem/layouts/sl28vpd.c index e93b020b0836..79de1e6947d0 100644 --- a/drivers/nvmem/layouts/sl28vpd.c +++ b/drivers/nvmem/layouts/sl28vpd.c @@ -126,6 +126,7 @@ static int sl28vpd_add_cells(struct nvmem_layout *layout) ret = nvmem_add_one_cell(nvmem, &info); if (ret) { + of_node_put(info.np); of_node_put(layout_np); return ret; }