Re: [PATCH] pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank()

[Antonio Borneo <antonio.borneo@foss.st.com>]

On Sun, 2026-10-11 at 14:17 +0800, Ma Ke wrote:
> stm32_gpiolib_register_bank() walks the "gpio-ranges" property with
> fwnode_property_get_reference_args().  As documented in
> drivers/base/property.c:
> 
>  * The caller is responsible for calling fwnode_handle_put() on the
>  * returned @args->fwnode pointer.
> 
> The returned reference is never put.  The function calls the helper
> twice, once directly and then repeatedly in a while loop, and each
> call overwrites args, so only the last reference is even reachable
> and all the earlier ones are leaked for good.
> 
> Put the reference as soon as args.args[] has been consumed, both for
> the initial call and for every iteration of the loop.
> 
> Found by code review.
> 
> Cc: stable@vger.kernel.org
> Fixes: bb949ed9b16b ("pinctrl: stm32: Switch to use for_each_gpiochip_node() helper")
> Signed-off-by: Ma Ke <make_ruc2021@163.com>
> ---
>  drivers/pinctrl/stm32/pinctrl-stm32.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
> index 6a99708a5a23..93127da05d56 100644
> --- a/drivers/pinctrl/stm32/pinctrl-stm32.c
> +++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
> @@ -1666,8 +1666,12 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode
>  
>                 /* get the last defined gpio line (offset + nb of pins) */
>                 npins = args.args[0] + args.args[2];
> -               while (!fwnode_property_get_reference_args(fwnode, "gpio-ranges", NULL, 3, ++i, &args))
> +               fwnode_handle_put(args.fwnode);
> +
> +               while (!fwnode_property_get_reference_args(fwnode, "gpio-ranges", NULL, 3, ++i, &args)) {
>                         npins = max(npins, (int)(args.args[0] + args.args[2]));
> +                       fwnode_handle_put(args.fwnode);
> +               }
>         } else {
>                 bank_nr = pctl->nbanks;
>                 bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK;

Reviewed-by: Antonio Borneo <antonio.borneo@foss.st.com>

Thanks!
Antonio