public inbox for linux-hwmon@vger.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev, stable@vger.kernel.org
Cc: Felix Gu <gu_0233@qq.com>, Guenter Roeck <linux@roeck-us.net>,
	Sasha Levin <sashal@kernel.org>,
	linux-hwmon@vger.kernel.org
Subject: [PATCH AUTOSEL 6.19-6.18] hwmon: (emc2305) Fix a resource leak in emc2305_of_parse_pwm_child
Date: Fri, 13 Feb 2026 19:59:28 -0500	[thread overview]
Message-ID: <20260214010245.3671907-88-sashal@kernel.org> (raw)
In-Reply-To: <20260214010245.3671907-1-sashal@kernel.org>

From: Felix Gu <gu_0233@qq.com>

[ Upstream commit 2954ce672b7623478c1cfeb69e6a6e4042a3656e ]

When calling of_parse_phandle_with_args(), the caller is responsible
to call of_node_put() to release the reference of device node.
In emc2305_of_parse_pwm_child, it does not release the reference,
causing a resource leak.

Signed-off-by: Felix Gu <gu_0233@qq.com>
Link: https://lore.kernel.org/r/tencent_738BA80BBF28F3440301EEE6F9E470165105@qq.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

Looking at the full function:

1. **Line 551**: `of_parse_phandle_with_args()` is called, which sets
   `args.np` to a device node with an incremented refcount.
2. **Line 553-554**: If `ret` is non-zero, we return early - but
   `args.np` is not set in the error case (the function failed), so no
   leak there.
3. **Line 581** (before patch): `return 0;` without calling
   `of_node_put(args.np)` - this is the leak.
4. **Line 581** (after patch): `of_node_put(args.np);` is added before
   `return 0;`.

The fix is correct. There's only one successful return path after
`of_parse_phandle_with_args()`, and that's the `return 0;` at the end.
The error return at line 554 doesn't need `of_node_put()` because
`of_parse_phandle_with_args()` failed and didn't set `args.np`.

### Classification

This is a **resource leak fix** — a missing `of_node_put()` call. This
is one of the most common types of stable backport fixes (reference
counting bugs). The device tree node reference count will never be
decremented, preventing the node from being freed.

### Scope and Risk Assessment

- **Size**: Single line addition — minimal.
- **Risk**: Essentially zero. `of_node_put()` is a standard, well-tested
  kernel API. Calling it on the `args.np` returned by
  `of_parse_phandle_with_args()` is the correct and expected pattern.
  This cannot introduce a regression.
- **Files affected**: 1 file, 1 line.

### User Impact

The emc2305 is a fan controller chip used in embedded systems. This leak
occurs every time the device tree parsing runs for each PWM child node.
While a single leaked reference is small, on systems with hot-plugging
or repeated probe/remove cycles, it accumulates. More importantly, this
is a correctness issue — violating the OF API contract.

### Stability Indicators

- The fix follows a well-established kernel pattern (of_node_put after
  of_parse_phandle_with_args).
- It was reviewed and accepted by the hwmon maintainer Guenter Roeck.
- It's a textbook one-line reference counting fix.

### Dependency Check

No dependencies. The `of_node_put()` API and the emc2305 driver have
been in the kernel for a long time.

### Conclusion

This is a textbook stable backport candidate:
- Fixes a real bug (device tree node reference leak)
- Obviously correct (standard kernel pattern)
- Minimal scope (one line)
- Zero regression risk
- No new features or API changes

**YES**

 drivers/hwmon/emc2305.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c
index ceae96c07ac45..67e82021da210 100644
--- a/drivers/hwmon/emc2305.c
+++ b/drivers/hwmon/emc2305.c
@@ -578,6 +578,7 @@ static int emc2305_of_parse_pwm_child(struct device *dev,
 		data->pwm_output_mask |= EMC2305_OPEN_DRAIN << ch;
 	}
 
+	of_node_put(args.np);
 	return 0;
 }
 
-- 
2.51.0


  parent reply	other threads:[~2026-02-14  1:06 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20260214010245.3671907-1-sashal@kernel.org>
2026-02-14  0:58 ` [PATCH AUTOSEL 6.19] hwmon: (asus-ec-sensors) add Pro WS TRX50-SAGE WIFI A Sasha Levin
2026-02-14  0:58 ` [PATCH AUTOSEL 6.19-6.18] hwmon: (nct6683) Add customer ID for ASRock Z590 Taichi Sasha Levin
2026-02-14  0:59 ` [PATCH AUTOSEL 6.19-6.1] hwmon: (f71882fg) Add F81968 support Sasha Levin
2026-02-14  0:59 ` Sasha Levin [this message]
2026-02-14  0:59 ` [PATCH AUTOSEL 6.19-6.6] hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE Sasha Levin
2026-02-14  0:59 ` [PATCH AUTOSEL 6.19-6.18] hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin Sasha Levin
2026-02-14  1:00 ` [PATCH AUTOSEL 6.19-6.12] hwmon: (dell-smm) Add support for Dell OptiPlex 7080 Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260214010245.3671907-88-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=gu_0233@qq.com \
    --cc=linux-hwmon@vger.kernel.org \
    --cc=linux@roeck-us.net \
    --cc=patches@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox