[PATCH net-next] net: dsa: hellcreek: fix device_node leak in hellcreek_led_setup()

[PATCH net-next] net: dsa: hellcreek: fix device_node leak in hellcreek_led_setup()

[Xia Yan]

hellcreek_led_setup() walks the two LED child nodes of the "leds" node
with of_get_next_available_child(). The helper drops the reference on
the child passed to it and takes one on the child it returns. After
the second call the caller holds a reference on the second LED node.

That reference is never dropped. The out: label only releases the
"leds" node itself. Boards with both LED child nodes leak one
device_node reference per probe, on the registration failures as well
as on the success path.

Drop it at the out: label, before the parent node. The early exits,
where the walk stopped before the second child, pass NULL, which
of_node_put() ignores.

Found during a code review of the OF node handling in DSA drivers.

Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>
---
  drivers/net/dsa/hirschmann/hellcreek_ptp.c | 1 +
  1 file changed, 1 insertion(+)
diff --git a/drivers/net/dsa/hirschmann/hellcreek_ptp.c b/drivers/net/dsa/hirschmann/hellcreek_ptp.c
index cb23bea9c21b..ed27731d4f4e 100644
--- a/drivers/net/dsa/hirschmann/hellcreek_ptp.c
+++ b/drivers/net/dsa/hirschmann/hellcreek_ptp.c
@@ -392,6 +392,7 @@ static int hellcreek_led_setup(struct hellcreek *hellcreek)
 	ret = 0;
 
 out:
+	of_node_put(led);
 	of_node_put(leds);
 
 	return ret;

Re: [PATCH net-next] net: dsa: hellcreek: fix device_node leak in hellcreek_led_setup()

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net-next] net: dsa: hellcreek: fix device_node leak in hellcreek_led_setup()

[Xia Yan]

On 11/6/26 16:51, netdev-bot+sinfo wrote:
>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.

Hi,

The leak was not hit at runtime. I found it by code inspection while
reviewing the OF node handling in DSA drivers, as the commit message
notes. There is no stack trace: the effect would be one device_node
reference leaked per probe and never released.

Thanks,
Xia Yan

Re: [PATCH net-next] net: dsa: hellcreek: fix device_node leak in hellcreek_led_setup()

[Kurt Kanzenbach]

[-- Attachment #1: Type: text/plain, Size: 926 bytes --]

On Fri Nov 06 2026, Xia Yan wrote:
> hellcreek_led_setup() walks the two LED child nodes of the "leds" node
> with of_get_next_available_child(). The helper drops the reference on
> the child passed to it and takes one on the child it returns. After
> the second call the caller holds a reference on the second LED node.
>
> That reference is never dropped. The out: label only releases the
> "leds" node itself. Boards with both LED child nodes leak one
> device_node reference per probe, on the registration failures as well
> as on the success path.
>
> Drop it at the out: label, before the parent node. The early exits,
> where the walk stopped before the second child, pass NULL, which
> of_node_put() ignores.
>
> Found during a code review of the OF node handling in DSA drivers.
>
> Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>

Looks correct to me. Thanks.

Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]