[PATCH] thermal: thermal_of: Fix device node reference leak in thermal_of_cm_lookup

[PATCH] thermal: thermal_of: Fix device node reference leak in thermal_of_cm_lookup

[Miaoqian Lin]

In thermal_of_cm_lookup(), of_parse_phandle() returns a device node with
its reference count incremented. The caller is responsible for releasing
this reference when the node is no longer needed.

Add of_node_put(tr_np) to fix the reference leaks.

Found via static analysis.

Fixes: 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
---
 drivers/thermal/thermal_of.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c
index 1a51a4d240ff..2bb1b8e471cf 100644
--- a/drivers/thermal/thermal_of.c
+++ b/drivers/thermal/thermal_of.c
@@ -284,8 +284,11 @@ static bool thermal_of_cm_lookup(struct device_node *cm_np,
 		int count, i;
 
 		tr_np = of_parse_phandle(child, "trip", 0);
-		if (tr_np != trip->priv)
+		if (tr_np != trip->priv) {
+			of_node_put(tr_np);
 			continue;
+		}
+		of_node_put(tr_np);
 
 		/* The trip has been found, look up the cdev. */
 		count = of_count_phandle_with_args(child, "cooling-device",
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] thermal: thermal_of: Fix device node reference leak in thermal_of_cm_lookup

[Rafael J. Wysocki]

On Tue, Oct 28, 2025 at 7:08 AM Miaoqian Lin <linmq006@gmail.com> wrote:
>
> In thermal_of_cm_lookup(), of_parse_phandle() returns a device node with
> its reference count incremented. The caller is responsible for releasing
> this reference when the node is no longer needed.
>
> Add of_node_put(tr_np) to fix the reference leaks.
>
> Found via static analysis.
>
> Fixes: 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization")
> Cc: stable@vger.kernel.org
> Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
> ---
>  drivers/thermal/thermal_of.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c
> index 1a51a4d240ff..2bb1b8e471cf 100644
> --- a/drivers/thermal/thermal_of.c
> +++ b/drivers/thermal/thermal_of.c
> @@ -284,8 +284,11 @@ static bool thermal_of_cm_lookup(struct device_node *cm_np,
>                 int count, i;
>
>                 tr_np = of_parse_phandle(child, "trip", 0);
> -               if (tr_np != trip->priv)
> +               if (tr_np != trip->priv) {
> +                       of_node_put(tr_np);
>                         continue;
> +               }
> +               of_node_put(tr_np);

This will also work because tr_np is not dereferenced below:

                tr_np = of_parse_phandle(child, "trip", 0);
                of_node_put(tr_np);
                if (tr_np != trip->priv)
                                continue;

but a more general question is whether or not device nodes used for
populating thermal zone trip points can be let go.

If not, then this change needs to be combined with another one that
will prevent them from going away.

Presumably they need to be reference counted in
thermal_of_populate_trip().  Daniel?

>
>                 /* The trip has been found, look up the cdev. */
>                 count = of_count_phandle_with_args(child, "cooling-device",
> --