[PATCH v2] soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()

[PATCH v2] soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()

[Weigang He]

exynos_get_pmu_regmap() obtains a device_node via of_find_matching_node()
and passes it to exynos_get_pmu_regmap_by_phandle(np, NULL). With
propname == NULL the callee uses np directly and does not drop a
reference, so the reference taken by of_find_matching_node() is leaked on
every call -- including on each -EPROBE_DEFER retry of the only in-tree
caller, exynos_retention_init() in the Exynos pinctrl driver.

Annotate np with the __free(device_node) cleanup attribute so the
reference is released when the function returns.

Found by static analysis tool CodeQL.

Fixes: 76640b84bd7a ("soc: samsung: pmu: Provide global function to get PMU regmap")
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
---
v2:
 - Use the __free(device_node) cleanup attribute instead of an explicit
   of_node_put(), as suggested by Krzysztof Kozlowski.
 - Drop the former patch 2/2 (regmap lookup helper refactor); with
   __free() the leak is fixed in place and the refactor is no longer
   needed.
v1: https://lore.kernel.org/linux-samsung-soc/  (<<FILL IN v1 Message-ID link>>)

 drivers/soc/samsung/exynos-pmu.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c
index d58376c38179b..265a095316079 100644
--- a/drivers/soc/samsung/exynos-pmu.c
+++ b/drivers/soc/samsung/exynos-pmu.c
@@ -167,11 +167,13 @@ static const struct mfd_cell exynos_pmu_devs[] = {
  */
 struct regmap *exynos_get_pmu_regmap(void)
 {
-	struct device_node *np = of_find_matching_node(NULL,
-						      exynos_pmu_of_device_ids);
-	if (np)
-		return exynos_get_pmu_regmap_by_phandle(np, NULL);
-	return ERR_PTR(-ENODEV);
+	struct device_node *np __free(device_node) =
+		of_find_matching_node(NULL, exynos_pmu_of_device_ids);
+
+	if (!np)
+		return ERR_PTR(-ENODEV);
+
+	return exynos_get_pmu_regmap_by_phandle(np, NULL);
 }
 EXPORT_SYMBOL_GPL(exynos_get_pmu_regmap);
 

base-commit: 0f61b1860cc3f52aef9036d7235ed1f017632193
-- 
2.43.0

Re: [PATCH v2] soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()

[Krzysztof Kozlowski]

On 09/06/2026 15:33, Weigang He wrote:
>  drivers/soc/samsung/exynos-pmu.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c
> index d58376c38179b..265a095316079 100644
> --- a/drivers/soc/samsung/exynos-pmu.c
> +++ b/drivers/soc/samsung/exynos-pmu.c
> @@ -167,11 +167,13 @@ static const struct mfd_cell exynos_pmu_devs[] = {
>   */
>  struct regmap *exynos_get_pmu_regmap(void)
>  {
> -	struct device_node *np = of_find_matching_node(NULL,
> -						      exynos_pmu_of_device_ids);
> -	if (np)
> -		return exynos_get_pmu_regmap_by_phandle(np, NULL);
> -	return ERR_PTR(-ENODEV);
> +	struct device_node *np __free(device_node) =
> +		of_find_matching_node(NULL, exynos_pmu_of_device_ids);
> +
> +	if (!np)
> +		return ERR_PTR(-ENODEV);
> +
> +	return exynos_get_pmu_regmap_by_phandle(np, NULL);

I don't understand why do you need to change the rest of the function.

Best regards,
Krzysztof