On Wed, Apr 17, 2024 at 06:30:59PM +0300, Andy Shevchenko wrote: > On Mon, Apr 15, 2024 at 06:53:28PM +0800, Zeng Heng wrote: > > If we fail to allocate propname buffer, we need to drop the reference > > count we just took. Because the pinctrl_dt_free_maps() includes the > > droping operation, here we call it directly. > > ... > > > for (state = 0; ; state++) { > > /* Retrieve the pinctrl-* property */ > > propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state); > > - if (!propname) > > - return -ENOMEM; > > + if (!propname) { > > + ret = -ENOMEM; > > + goto err; > > + } > > prop = of_find_property(np, propname, &size); > > kfree(propname); > > if (!prop) { > > if (state == 0) { > > - of_node_put(np); > > - return -ENODEV; > > + ret = -ENODEV; > > + goto err; > > Has it been tested? How on earth is this a correct change? > > We iterate over state numbers until we have properties available. This chunk is > _successful_ exit path, we may not free parsed maps! Am I wrong? In this path state == 0 so we haven't had a successful iteration yet. regards, dan carpenter