[PATCH] pinctrl: imx1-core: fix device_node refcount leak

[PATCH] pinctrl: imx1-core: fix device_node refcount leak

[Manush Prajwal]

imx1_pinctrl_dt_is_flat_functions() iterates child and grandchild
device nodes with for_each_child_of_node() but returns early from
inside both loops without dropping the reference the iterator holds
on the current node. Since the function returns a bool rather than a
node, there is no legitimate reason to keep the reference: call
of_node_put() on both loop variables before the early returns.

Found by inspection; the sibling helper in pinctrl-imx.c avoids this
by using for_each_child_of_node_scoped() instead.

Signed-off-by: Manush Prajwal <manushprajwal555@gmail.com>
---
 drivers/pinctrl/freescale/pinctrl-imx1-core.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
index b7bd4ef9c0..fa8f6a7e03 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
@@ -551,12 +551,17 @@ static bool imx1_pinctrl_dt_is_flat_functions(struct device_node *np)
 	struct device_node *pinctrl_np;
 
 	for_each_child_of_node(np, function_np) {
-		if (of_property_present(function_np, "fsl,pins"))
+		if (of_property_present(function_np, "fsl,pins")) {
+			of_node_put(function_np);
 			return true;
+		}
 
 		for_each_child_of_node(function_np, pinctrl_np) {
-			if (of_property_present(pinctrl_np, "fsl,pins"))
+			if (of_property_present(pinctrl_np, "fsl,pins")) {
+				of_node_put(pinctrl_np);
+				of_node_put(function_np);
 				return false;
+			}
 		}
 	}
 
-- 
2.46.2.windows.1

Re: [PATCH] pinctrl: imx1-core: fix device_node refcount leak

[Frank Li]

On Thu, Aug 13, 2026 at 04:39:38PM +0530, Manush Prajwal wrote:
> [You don't often get email from manushprajwal555@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> imx1_pinctrl_dt_is_flat_functions() iterates child and grandchild
> device nodes with for_each_child_of_node() but returns early from
> inside both loops without dropping the reference the iterator holds
> on the current node. Since the function returns a bool rather than a
> node, there is no legitimate reason to keep the reference: call
> of_node_put() on both loop variables before the early returns.
>
> Found by inspection; the sibling helper in pinctrl-imx.c avoids this
> by using for_each_child_of_node_scoped() instead.
>
> Signed-off-by: Manush Prajwal <manushprajwal555@gmail.com>
> ---
>  drivers/pinctrl/freescale/pinctrl-imx1-core.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
> index b7bd4ef9c0..fa8f6a7e03 100644
> --- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
> +++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
> @@ -551,12 +551,17 @@ static bool imx1_pinctrl_dt_is_flat_functions(struct device_node *np)
>         struct device_node *pinctrl_np;
>
>         for_each_child_of_node(np, function_np) {

use for_each_child_of_node_scoped() to fix it.

Frank

> -               if (of_property_present(function_np, "fsl,pins"))
> +               if (of_property_present(function_np, "fsl,pins")) {
> +                       of_node_put(function_np);
>                         return true;
> +               }
>
>                 for_each_child_of_node(function_np, pinctrl_np) {
> -                       if (of_property_present(pinctrl_np, "fsl,pins"))
> +                       if (of_property_present(pinctrl_np, "fsl,pins")) {
> +                               of_node_put(pinctrl_np);
> +                               of_node_put(function_np);
>                                 return false;
> +                       }
>                 }
>         }
>
> --
> 2.46.2.windows.1
>
>