[PATCH 2/2] nvmem: layouts: onie-tlv: fix device_node reference leak in error path

[PATCH 2/2] nvmem: layouts: onie-tlv: fix device_node reference leak in error path

[Leo Cheng]

onie_tlv_add_cells() takes a reference on the child node via
of_get_child_by_name() for each parsed TLV and passes it to
nvmem_add_one_cell() as cell.np. On success the created cell entry
adopts that reference and releases it later via of_node_put(); on
failure nvmem_add_one_cell() does not consume it, so the caller still
owns it, but the error path only puts layout before returning, leaking
the child node reference.

Put cell.np on the error path as well. of_node_put(NULL) is a no-op, so
this is safe even when of_get_child_by_name() returned NULL.

Fixes: d3c0d12f6474 ("nvmem: layouts: onie-tlv: Add new layout driver")
Signed-off-by: Leo Cheng <leo-cheng@vip.qq.com>
---
 drivers/nvmem/layouts/onie-tlv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/nvmem/layouts/onie-tlv.c b/drivers/nvmem/layouts/onie-tlv.c
index 8b0f3c1b8..4da3a7043 100644
--- a/drivers/nvmem/layouts/onie-tlv.c
+++ b/drivers/nvmem/layouts/onie-tlv.c
@@ -128,6 +128,7 @@ static int onie_tlv_add_cells(struct device *dev, struct nvmem_device *nvmem,
 
 		ret = nvmem_add_one_cell(nvmem, &cell);
 		if (ret) {
+			of_node_put(cell.np);
 			of_node_put(layout);
 			return ret;
 		}
-- 
2.43.0

Re: [PATCH 2/2] nvmem: layouts: onie-tlv: fix device_node reference leak in error path

[Michael Walle]

On Tue Aug 11, 2026 at 2:55 PM CEST, Leo Cheng wrote:
> onie_tlv_add_cells() takes a reference on the child node via
> of_get_child_by_name() for each parsed TLV and passes it to
> nvmem_add_one_cell() as cell.np. On success the created cell entry
> adopts that reference and releases it later via of_node_put(); on
> failure nvmem_add_one_cell() does not consume it, so the caller still
> owns it, but the error path only puts layout before returning, leaking
> the child node reference.
>
> Put cell.np on the error path as well. of_node_put(NULL) is a no-op, so
> this is safe even when of_get_child_by_name() returned NULL.
>
> Fixes: d3c0d12f6474 ("nvmem: layouts: onie-tlv: Add new layout driver")
> Signed-off-by: Leo Cheng <leo-cheng@vip.qq.com>

Reviewed-by: Michael Walle <mwalle@kernel.org>