From 9d44e80151dd360fad6155f36b6bfa57efb0f2f5 Mon Sep 17 00:00:00 2001 From: Leo Cheng Date: Fri, 2 Oct 2026 11:13:28 +0100 Subject: [PATCH] nvmem: layouts: onie-tlv: fix device_node reference leak in error path onie_tlv_add_cells() takes a reference on the child node via of_get_child_by_name() for each parsed TLV and passes it to nvmem_add_one_cell() as cell.np. On success the created cell entry adopts that reference and releases it later via of_node_put(); on failure nvmem_add_one_cell() does not consume it, so the caller still owns it, but the error path only puts layout before returning, leaking the child node reference. Put cell.np on the error path as well. of_node_put(NULL) is a no-op, so this is safe even when of_get_child_by_name() returned NULL. Fixes: d3c0d12f6474 ("nvmem: layouts: onie-tlv: Add new layout driver") Signed-off-by: Leo Cheng Reviewed-by: Michael Walle Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20261002101329.1084348-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/nvmem/layouts/onie-tlv.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/nvmem/layouts/onie-tlv.c b/drivers/nvmem/layouts/onie-tlv.c index 8b0f3c1b8a0e..4da3a704388e 100644 --- a/drivers/nvmem/layouts/onie-tlv.c +++ b/drivers/nvmem/layouts/onie-tlv.c @@ -128,6 +128,7 @@ static int onie_tlv_add_cells(struct device *dev, struct nvmem_device *nvmem, ret = nvmem_add_one_cell(nvmem, &cell); if (ret) { + of_node_put(cell.np); of_node_put(layout); return ret; }