[PATCH] leds: netxbig: Fix platform device reference leak on successful probe

[PATCH] leds: netxbig: Fix platform device reference leak on successful probe

[Wentao Liang]

of_find_device_by_node() returns the GPIO extension device with an
elevated reference count.  The error paths release it through the
put_device label, but the success path returns directly, so the
reference is leaked whenever the LED driver probes successfully.

Let the success path fall through to the put_device label.

Fixes: 9af512e81964 ("leds: netxbig: Convert to use GPIO descriptors")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/leds/leds-netxbig.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
index 99df46f2d9f5..d79fee1d9143 100644
--- a/drivers/leds/leds-netxbig.c
+++ b/drivers/leds/leds-netxbig.c
@@ -597,8 +597,7 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 	pdata->leds = leds;
 	pdata->num_leds = num_leds;
 
-	return 0;
-
+	ret = 0;
 put_device:
 	put_device(gpio_ext_dev);
 	return ret;
-- 
2.34.1

Re: [PATCH] leds: netxbig: Fix platform device reference leak on successful probe

[sashiko-bot]

> of_find_device_by_node() returns the GPIO extension device with an
> elevated reference count.  The error paths release it through the
> put_device label, but the success path returns directly, so the
> reference is leaked whenever the LED driver probes successfully.
> 
> Let the success path fall through to the put_device label.
> 
> Fixes: 9af512e81964 ("leds: netxbig: Convert to use GPIO descriptors")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917093641.2144866-1-vulab@iscas.ac.cn?part=1

Re: [PATCH] leds: netxbig: Fix platform device reference leak on successful probe

[Lee Jones]

On Thu, 17 Sep 2026, Wentao Liang wrote:

> of_find_device_by_node() returns the GPIO extension device with an
> elevated reference count.  The error paths release it through the
> put_device label, but the success path returns directly, so the
> reference is leaked whenever the LED driver probes successfully.
> 
> Let the success path fall through to the put_device label.
> 
> Fixes: 9af512e81964 ("leds: netxbig: Convert to use GPIO descriptors")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/leds/leds-netxbig.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
> index 99df46f2d9f5..d79fee1d9143 100644
> --- a/drivers/leds/leds-netxbig.c
> +++ b/drivers/leds/leds-netxbig.c
> @@ -597,8 +597,7 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
>  	pdata->leds = leds;
>  	pdata->num_leds = num_leds;
>  
> -	return 0;
> -
> +	ret = 0;
>  put_device:
>  	put_device(gpio_ext_dev);
> 	return ret;

Or you could do a nicer clean-up by putting it after last use, then
remove all of the gotos?

-- 
Lee Jones

[PATCH v2] leds: netxbig: Fix platform device reference leak on successful probe

[Wentao Liang]

of_find_device_by_node() returns the GPIO extension device with an
elevated reference count.  The error paths release it through the
put_device label, but the success path returns directly, so the
reference is leaked whenever the LED driver probes successfully.

Release the reference right after its last use and remove the put_device
label and the gotos leading to it.

Fixes: 9af512e81964 ("leds: netxbig: Convert to use GPIO descriptors")
Suggested-by: Lee Jones <lee@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
 - Release the reference right after its last use and remove the put_device
   label and the gotos, as suggested.
 - Apologies for the very late reply. 
 drivers/leds/leds-netxbig.c | 74 ++++++++++++++-----------------------
 1 file changed, 27 insertions(+), 47 deletions(-)

diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
index 99df46f2d9f5..3a0456eae2c3 100644
--- a/drivers/leds/leds-netxbig.c
+++ b/drivers/leds/leds-netxbig.c
@@ -462,41 +462,36 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 	gpio_ext_dev = &gpio_ext_pdev->dev;
 
 	gpio_ext = devm_kzalloc(dev, sizeof(*gpio_ext), GFP_KERNEL);
-	if (!gpio_ext) {
-		of_node_put(gpio_ext_np);
+	if (!gpio_ext)
 		ret = -ENOMEM;
-		goto put_device;
-	}
-	ret = netxbig_gpio_ext_get(dev, gpio_ext_dev, gpio_ext);
+	else
+		ret = netxbig_gpio_ext_get(dev, gpio_ext_dev, gpio_ext);
+
 	of_node_put(gpio_ext_np);
+	put_device(gpio_ext_dev);
 	if (ret)
-		goto put_device;
+		return ret;
+
 	pdata->gpio_ext = gpio_ext;
 
 	/* Timers (optional) */
 	ret = of_property_count_u32_elems(np, "timers");
 	if (ret > 0) {
-		if (ret % 3) {
-			ret = -EINVAL;
-			goto put_device;
-		}
+		if (ret % 3)
+			return -EINVAL;
 
 		num_timers = ret / 3;
 		timers = devm_kcalloc(dev, num_timers, sizeof(*timers),
 				      GFP_KERNEL);
-		if (!timers) {
-			ret = -ENOMEM;
-			goto put_device;
-		}
+		if (!timers)
+			return -ENOMEM;
 		for (i = 0; i < num_timers; i++) {
 			u32 tmp;
 
 			of_property_read_u32_index(np, "timers", 3 * i,
 						   &timers[i].mode);
-			if (timers[i].mode >= NETXBIG_LED_MODE_NUM) {
-				ret = -EINVAL;
-				goto put_device;
-			}
+			if (timers[i].mode >= NETXBIG_LED_MODE_NUM)
+				return -EINVAL;
 			of_property_read_u32_index(np, "timers",
 						   3 * i + 1, &tmp);
 			timers[i].delay_on = tmp;
@@ -512,15 +507,12 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 	num_leds = of_get_available_child_count(np);
 	if (!num_leds) {
 		dev_err(dev, "No LED subnodes found in DT\n");
-		ret = -ENODEV;
-		goto put_device;
+		return -ENODEV;
 	}
 
 	leds = devm_kcalloc(dev, num_leds, sizeof(*leds), GFP_KERNEL);
-	if (!leds) {
-		ret = -ENOMEM;
-		goto put_device;
-	}
+	if (!leds)
+		return -ENOMEM;
 
 	led = leds;
 	for_each_available_child_of_node_scoped(np, child) {
@@ -531,40 +523,34 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 		ret = of_property_read_u32(child, "mode-addr",
 					   &led->mode_addr);
 		if (ret)
-			goto put_device;
+			return ret;
 
 		ret = of_property_read_u32(child, "bright-addr",
 					   &led->bright_addr);
 		if (ret)
-			goto put_device;
+			return ret;
 
 		ret = of_property_read_u32(child, "max-brightness",
 					   &led->bright_max);
 		if (ret)
-			goto put_device;
+			return ret;
 
 		mode_val =
 			devm_kcalloc(dev,
 				     NETXBIG_LED_MODE_NUM, sizeof(*mode_val),
 				     GFP_KERNEL);
-		if (!mode_val) {
-			ret = -ENOMEM;
-			goto put_device;
-		}
+		if (!mode_val)
+			return -ENOMEM;
 
 		for (i = 0; i < NETXBIG_LED_MODE_NUM; i++)
 			mode_val[i] = NETXBIG_LED_INVALID_MODE;
 
 		ret = of_property_count_u32_elems(child, "mode-val");
-		if (ret < 0 || ret % 2) {
-			ret = -EINVAL;
-			goto put_device;
-		}
+		if (ret < 0 || ret % 2)
+			return -EINVAL;
 		num_modes = ret / 2;
-		if (num_modes > NETXBIG_LED_MODE_NUM) {
-			ret = -EINVAL;
-			goto put_device;
-		}
+		if (num_modes > NETXBIG_LED_MODE_NUM)
+			return -EINVAL;
 
 		for (i = 0; i < num_modes; i++) {
 			int mode;
@@ -574,10 +560,8 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 						   "mode-val", 2 * i, &mode);
 			of_property_read_u32_index(child,
 						   "mode-val", 2 * i + 1, &val);
-			if (mode >= NETXBIG_LED_MODE_NUM) {
-				ret = -EINVAL;
-				goto put_device;
-			}
+			if (mode >= NETXBIG_LED_MODE_NUM)
+				return -EINVAL;
 			mode_val[mode] = val;
 		}
 		led->mode_val = mode_val;
@@ -598,10 +582,6 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 	pdata->num_leds = num_leds;
 
 	return 0;
-
-put_device:
-	put_device(gpio_ext_dev);
-	return ret;
 }
 
 static const struct of_device_id of_netxbig_leds_match[] = {
-- 
2.25.1

Re: [PATCH v2] leds: netxbig: Fix platform device reference leak on successful probe

[sashiko-bot]

> of_find_device_by_node() returns the GPIO extension device with an
> elevated reference count.  The error paths release it through the
> put_device label, but the success path returns directly, so the
> reference is leaked whenever the LED driver probes successfully.
> 
> Release the reference right after its last use and remove the put_device
> label and the gotos leading to it.
> 
> Fixes: 9af512e81964 ("leds: netxbig: Convert to use GPIO descriptors")
> Suggested-by: Lee Jones <lee@kernel.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107042737.708109-1-vulab@iscas.ac.cn?part=1