qcom_smd_register_edge() leaks an OF node reference when
qcom_smd_create_chrdev() fails, since qcom_smd_parse_edge() sets
of_node_get(node) to edge->of_node. Add of_node_put() calls to the error
path of qcom_smd_register_edge() and qcom_smd_unregister_edge().
This was found by an experimental verifier that I am developing. Due to
the lack of actual devices, no runtime test was able to be performed.
Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend")
Signed-off-by: Joe Hattori <joe@xxxxxxxxxxxxxxxxxxxxx>
---
Changes in v2:
- Put edge->of_node for clarity.
---
drivers/rpmsg/qcom_smd.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
index 40d386809d6b..c2bb4887424f 100644
--- a/drivers/rpmsg/qcom_smd.c
+++ b/drivers/rpmsg/qcom_smd.c
@@ -1509,13 +1509,15 @@ struct qcom_smd_edge *qcom_smd_register_edge(struct device *parent,
ret = qcom_smd_create_chrdev(edge);
if (ret) {
dev_err(&edge->dev, "failed to register chrdev for edge\n");
- goto unregister_dev;
+ goto put_node;
}
schedule_work(&edge->scan_work);
return edge;
+put_node:
+ of_node_put(edge->of_node);
unregister_dev:
if (!IS_ERR_OR_NULL(edge->mbox_chan))
mbox_free_channel(edge->mbox_chan);
@@ -1548,6 +1550,7 @@ void qcom_smd_unregister_edge(struct qcom_smd_edge *edge)
if (ret)
dev_warn(&edge->dev, "can't remove smd device: %d\n", ret);
+ of_node_put(edge->of_node);
mbox_free_channel(edge->mbox_chan);
device_unregister(&edge->dev);
}
--
2.34.1
