[PATCH] leds: flash: sgm3140: fix child node reference leak

[PATCH] leds: flash: sgm3140: fix child node reference leak

[Guangshuo Li]

sgm3140_probe() obtains a reference to the LED child node with
device_get_next_child_node(). The probe error path correctly drops this
reference with fwnode_handle_put(), but the successful probe path
returns without releasing it.

v4l2_flash_init() takes its own reference to the supplied fwnode and
v4l2_flash_release() drops that reference during device removal.
Therefore, the reference acquired by sgm3140_probe() is only needed
during probe and can be released once initialization has completed.

Drop the child node reference before returning successfully from probe.

This issue was found by manual code inspection.

Fixes: cef8ec8cbd21 ("leds: add sgm3140 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/leds/flash/leds-sgm3140.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/leds/flash/leds-sgm3140.c b/drivers/leds/flash/leds-sgm3140.c
index dc6840357370..51e31fdb78e5 100644
--- a/drivers/leds/flash/leds-sgm3140.c
+++ b/drivers/leds/flash/leds-sgm3140.c
@@ -273,7 +273,9 @@ static int sgm3140_probe(struct platform_device *pdev)
 		goto err;
 	}
 
-	return ret;
+	fwnode_handle_put(child_node);
+
+	return 0;
 
 err:
 	fwnode_handle_put(child_node);
-- 
2.43.0

Re: [PATCH] leds: flash: sgm3140: fix child node reference leak

[Laurent Pinchart]

On Mon, Sep 14, 2026 at 09:57:23PM +0800, Guangshuo Li wrote:
> sgm3140_probe() obtains a reference to the LED child node with
> device_get_next_child_node(). The probe error path correctly drops this
> reference with fwnode_handle_put(), but the successful probe path
> returns without releasing it.
> 
> v4l2_flash_init() takes its own reference to the supplied fwnode and
> v4l2_flash_release() drops that reference during device removal.

How about devm_led_classdev_flash_register_ext() ?

> Therefore, the reference acquired by sgm3140_probe() is only needed
> during probe and can be released once initialization has completed.
> 
> Drop the child node reference before returning successfully from probe.
> 
> This issue was found by manual code inspection.

I wonder what prompted you to manual inspect that code.

> Fixes: cef8ec8cbd21 ("leds: add sgm3140 driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/leds/flash/leds-sgm3140.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/leds/flash/leds-sgm3140.c b/drivers/leds/flash/leds-sgm3140.c
> index dc6840357370..51e31fdb78e5 100644
> --- a/drivers/leds/flash/leds-sgm3140.c
> +++ b/drivers/leds/flash/leds-sgm3140.c
> @@ -273,7 +273,9 @@ static int sgm3140_probe(struct platform_device *pdev)
>  		goto err;
>  	}
>  
> -	return ret;
> +	fwnode_handle_put(child_node);
> +
> +	return 0;
>  
>  err:
>  	fwnode_handle_put(child_node);

-- 
Regards,

Laurent Pinchart