Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Liang He <windhl@126.com>
To:     linus.walleij@linaro.org, linux@armlinux.org.uk
Cc:     windhl@126.com, linux-arm-kernel@lists.infradead.org,
        linux-kernel@vger.kernel.org
Subject: [PATCH] arm: mach-versatile: Fix refcount leak bug in tc2_pm
Date:   Fri, 17 Jun 2022 20:30:03 +0800
Message-Id: <20220617123003.4048328-1-windhl@126.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

In tc2_pm_init(), of_find_compatible_node() will return a node pointer
with refcount incremented. We should use of_node_put() in fail path or
when it is not used anymore.

Signed-off-by: Liang He <windhl@126.com>
---
 arch/arm/mach-versatile/tc2_pm.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-versatile/tc2_pm.c b/arch/arm/mach-versatile/tc2_pm.c
index 0fe78da0c109..2a7aeab7b3da 100644
--- a/arch/arm/mach-versatile/tc2_pm.c
+++ b/arch/arm/mach-versatile/tc2_pm.c
@@ -212,19 +212,24 @@ static int __init tc2_pm_init(void)
 	np = of_find_compatible_node(NULL, NULL,
 			"arm,vexpress-scc,v2p-ca15_a7");
 	scc = of_iomap(np, 0);
-	if (!scc)
+	if (!scc) {
+		of_node_put(np);
 		return -ENODEV;
+	}
 
 	a15_cluster_id = readl_relaxed(scc + A15_CONF) & 0xf;
 	a7_cluster_id = readl_relaxed(scc + A7_CONF) & 0xf;
-	if (a15_cluster_id >= TC2_CLUSTERS || a7_cluster_id >= TC2_CLUSTERS)
+	if (a15_cluster_id >= TC2_CLUSTERS || a7_cluster_id >= TC2_CLUSTERS) {
+		of_node_put(np);
 		return -EINVAL;
+	}
 
 	sys_info = readl_relaxed(scc + SYS_INFO);
 	tc2_nr_cpus[a15_cluster_id] = (sys_info >> 16) & 0xf;
 	tc2_nr_cpus[a7_cluster_id] = (sys_info >> 20) & 0xf;
 
 	irq = irq_of_parse_and_map(np, 0);
+	of_node_put(np);
 
 	/*
 	 * A subset of the SCC registers is also used to communicate
-- 
2.25.1