From: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxx> commit c0a1ef9c5be72ff28a5413deb1b3e1a066593c13 upstream. Terminating for_each_available_child_of_node() loop requires dropping OF node reference, so bailing out on errors misses this. Solve the OF node reference leak with scoped for_each_available_child_of_node_scoped(). Fixes: 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization") Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxx> Reviewed-by: Chen-Yu Tsai <wenst@xxxxxxxxxxxx> Reviewed-by: Daniel Lezcano <daniel.lezcano@xxxxxxxxxx> Link: https://patch.msgid.link/20240814195823.437597-3-krzysztof.kozlowski@xxxxxxxxxx Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/thermal/thermal_of.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) --- a/drivers/thermal/thermal_of.c +++ b/drivers/thermal/thermal_of.c @@ -294,14 +294,14 @@ static struct device_node *of_thermal_zo * Search for each thermal zone, a defined sensor * corresponding to the one passed as parameter */ - for_each_available_child_of_node(np, tz) { + for_each_available_child_of_node_scoped(np, child) { int count, i; - count = of_count_phandle_with_args(tz, "thermal-sensors", + count = of_count_phandle_with_args(child, "thermal-sensors", "#thermal-sensor-cells"); if (count <= 0) { - pr_err("%pOFn: missing thermal sensor\n", tz); + pr_err("%pOFn: missing thermal sensor\n", child); tz = ERR_PTR(-EINVAL); goto out; } @@ -310,18 +310,19 @@ static struct device_node *of_thermal_zo int ret; - ret = of_parse_phandle_with_args(tz, "thermal-sensors", + ret = of_parse_phandle_with_args(child, "thermal-sensors", "#thermal-sensor-cells", i, &sensor_specs); if (ret < 0) { - pr_err("%pOFn: Failed to read thermal-sensors cells: %d\n", tz, ret); + pr_err("%pOFn: Failed to read thermal-sensors cells: %d\n", child, ret); tz = ERR_PTR(ret); goto out; } if ((sensor == sensor_specs.np) && id == (sensor_specs.args_count ? sensor_specs.args[0] : 0)) { - pr_debug("sensor %pOFn id=%d belongs to %pOFn\n", sensor, id, tz); + pr_debug("sensor %pOFn id=%d belongs to %pOFn\n", sensor, id, child); + tz = no_free_ptr(child); goto out; } } Patches currently in stable-queue which might be from krzysztof.kozlowski@xxxxxxxxxx are queue-6.1/memory-stm32-fmc2-ebi-check-regmap_read-return-value.patch queue-6.1/memory-tegra-skip-sid-programming-if-sid-registers-a.patch queue-6.1/thermal-of-fix-of-node-leak-in-thermal_of_trips_init-error-path.patch queue-6.1/thermal-of-fix-of-node-leak-in-of_thermal_zone_find-error-paths.patch