Received-SPF: pass (google.com: domain of linux-kernel+bounces-150025-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: Zeng Heng <zengheng4@huawei.com>
To: <linus.walleij@linaro.org>, <dan.carpenter@linaro.org>,
	<andriy.shevchenko@intel.com>
CC: <linux-gpio@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
	<liwei391@huawei.com>
Subject: [PATCH v2 resend] pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
Date: Thu, 18 Apr 2024 19:58:13 +0800
Message-ID: <20240418115813.93241-1-zengheng4@huawei.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain

If we fail to allocate propname buffer, we need to drop the reference
count we just took, otherwise it will lead reference leak. Here the
error exit path is modified to jump to the err label and call
pinctrl_dt_free_maps() which would drop the counter.

In the meantime, if it is found that the property 'pinctrl-0' is not
present, ENODEV is returned and also jump to the err label and call the
free function, in case the Smatch tool complains.

Fixes: 91d5c5060ee2 ("pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map")
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Zeng Heng <zengheng4@huawei.com>
---
v2: add a comment and modify the commit message, without any logical
    changes.
---
 drivers/pinctrl/devicetree.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
index df1efc2e5202..37069e40af2b 100644
--- a/drivers/pinctrl/devicetree.c
+++ b/drivers/pinctrl/devicetree.c
@@ -220,14 +220,17 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev)
 	for (state = 0; ; state++) {
 		/* Retrieve the pinctrl-* property */
 		propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state);
-		if (!propname)
-			return -ENOMEM;
+		if (!propname) {
+			ret = -ENOMEM;
+			goto err;
+		}
 		prop = of_find_property(np, propname, &size);
 		kfree(propname);
 		if (!prop) {
 			if (state == 0) {
-				of_node_put(np);
-				return -ENODEV;
+				/* Return -ENODEV if the property 'pinctrl-0' is not present. */
+				ret = -ENODEV;
+				goto err;
 			}
 			break;
 		}
--
2.25.1