[PATCH 2/4] i2c: sun6i-p2wi: Fix device node reference leak in p2wi_probe

[PATCH 2/4] i2c: sun6i-p2wi: Fix device node reference leak in p2wi_probe

[Uday Khare]

In p2wi_probe(), the device node reference obtained via
of_get_next_available_child() is stored in childnp. This reference is
never released via of_node_put() - neither on the error path when
of_property_read_u32() fails to read the 'reg' property, nor on the
success path after the target address has been read.

Fix this by calling of_node_put(childnp) on both the error and success
paths.

Fixes: 3e833490fae5 ("i2c: sunxi: add P2WI (Push/Pull 2 Wire Interface) controller support")
Signed-off-by: Uday Khare <udaykhare77@gmail.com>
---
 drivers/i2c/busses/i2c-sun6i-p2wi.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c
index dffbe776a195..1ef0e82eeb63 100644
--- a/drivers/i2c/busses/i2c-sun6i-p2wi.c
+++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c
@@ -220,10 +220,13 @@ static int p2wi_probe(struct platform_device *pdev)
 	childnp = of_get_next_available_child(np, NULL);
 	if (childnp) {
 		ret = of_property_read_u32(childnp, "reg", &target_addr);
-		if (ret)
-			return dev_err_probe(dev, -EINVAL,
-					     "invalid target address on node %pOF\n", childnp);
-
+		if (ret) {
+			ret = dev_err_probe(dev, -EINVAL,
+					    "invalid target address on node %pOF\n", childnp);
+			of_node_put(childnp);
+			return ret;
+		}
+		of_node_put(childnp);
 		p2wi->target_addr = target_addr;
 	}
 
-- 
2.54.0

Re: [PATCH 2/4] i2c: sun6i-p2wi: Fix device node reference leak in p2wi_probe

[Chen-Yu Tsai]

On Thu, Jun 18, 2026 at 9:21 PM Uday Khare <udaykhare77@gmail.com> wrote:
>
> In p2wi_probe(), the device node reference obtained via
> of_get_next_available_child() is stored in childnp. This reference is
> never released via of_node_put() - neither on the error path when
> of_property_read_u32() fails to read the 'reg' property, nor on the
> success path after the target address has been read.
>
> Fix this by calling of_node_put(childnp) on both the error and success
> paths.
>
> Fixes: 3e833490fae5 ("i2c: sunxi: add P2WI (Push/Pull 2 Wire Interface) controller support")
> Signed-off-by: Uday Khare <udaykhare77@gmail.com>
> ---
>  drivers/i2c/busses/i2c-sun6i-p2wi.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c
> index dffbe776a195..1ef0e82eeb63 100644
> --- a/drivers/i2c/busses/i2c-sun6i-p2wi.c
> +++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c
> @@ -220,10 +220,13 @@ static int p2wi_probe(struct platform_device *pdev)


I would just include linux/cleanup.h and make the following line:

>         childnp = of_get_next_available_child(np, NULL);

          struct device_node *childnp __free(device_node) =
                  of_get_next_available_child(np, NULL);

No other changes needed, and much cleaner.

>         if (childnp) {
>                 ret = of_property_read_u32(childnp, "reg", &target_addr);
> -               if (ret)
> -                       return dev_err_probe(dev, -EINVAL,
> -                                            "invalid target address on node %pOF\n", childnp);
> -
> +               if (ret) {
> +                       ret = dev_err_probe(dev, -EINVAL,
> +                                           "invalid target address on node %pOF\n", childnp);
> +                       of_node_put(childnp);
> +                       return ret;
> +               }
> +               of_node_put(childnp);
>                 p2wi->target_addr = target_addr;
>         }
>
> --
> 2.54.0
>