[PATCH] leds: flash: sgm3140: fix child node reference leak

[PATCH] leds: flash: sgm3140: fix child node reference leak

[Guangshuo Li]

sgm3140_probe() obtains a reference to the LED child node with
device_get_next_child_node(). The probe error path correctly drops this
reference with fwnode_handle_put(), but the successful probe path
returns without releasing it.

v4l2_flash_init() takes its own reference to the supplied fwnode and
v4l2_flash_release() drops that reference during device removal.
Therefore, the reference acquired by sgm3140_probe() is only needed
during probe and can be released once initialization has completed.

Drop the child node reference before returning successfully from probe.

This issue was found by manual code inspection.

Fixes: cef8ec8cbd21 ("leds: add sgm3140 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/leds/flash/leds-sgm3140.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/leds/flash/leds-sgm3140.c b/drivers/leds/flash/leds-sgm3140.c
index dc6840357370..51e31fdb78e5 100644
--- a/drivers/leds/flash/leds-sgm3140.c
+++ b/drivers/leds/flash/leds-sgm3140.c
@@ -273,7 +273,9 @@ static int sgm3140_probe(struct platform_device *pdev)
 		goto err;
 	}
 
-	return ret;
+	fwnode_handle_put(child_node);
+
+	return 0;
 
 err:
 	fwnode_handle_put(child_node);
-- 
2.43.0

Re: [PATCH] leds: flash: sgm3140: fix child node reference leak

[Laurent Pinchart]

On Mon, Sep 14, 2026 at 09:57:23PM +0800, Guangshuo Li wrote:
> sgm3140_probe() obtains a reference to the LED child node with
> device_get_next_child_node(). The probe error path correctly drops this
> reference with fwnode_handle_put(), but the successful probe path
> returns without releasing it.
> 
> v4l2_flash_init() takes its own reference to the supplied fwnode and
> v4l2_flash_release() drops that reference during device removal.

How about devm_led_classdev_flash_register_ext() ?

> Therefore, the reference acquired by sgm3140_probe() is only needed
> during probe and can be released once initialization has completed.
> 
> Drop the child node reference before returning successfully from probe.
> 
> This issue was found by manual code inspection.

I wonder what prompted you to manual inspect that code.

> Fixes: cef8ec8cbd21 ("leds: add sgm3140 driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/leds/flash/leds-sgm3140.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/leds/flash/leds-sgm3140.c b/drivers/leds/flash/leds-sgm3140.c
> index dc6840357370..51e31fdb78e5 100644
> --- a/drivers/leds/flash/leds-sgm3140.c
> +++ b/drivers/leds/flash/leds-sgm3140.c
> @@ -273,7 +273,9 @@ static int sgm3140_probe(struct platform_device *pdev)
>  		goto err;
>  	}
>  
> -	return ret;
> +	fwnode_handle_put(child_node);
> +
> +	return 0;
>  
>  err:
>  	fwnode_handle_put(child_node);

-- 
Regards,

Laurent Pinchart

Re: [PATCH] leds: flash: sgm3140: fix child node reference leak

[Guangshuo Li]

Hi Laurent,

Thanks for the review.

On Mon, 14 Sept 2026 at 22:17, Laurent Pinchart
<laurent.pinchart@ideasonboard.com> wrote:
>
> On Mon, Sep 14, 2026 at 09:57:23PM +0800, Guangshuo Li wrote:
> > sgm3140_probe() obtains a reference to the LED child node with
> > device_get_next_child_node(). The probe error path correctly drops this
> > reference with fwnode_handle_put(), but the successful probe path
> > returns without releasing it.
> >
> > v4l2_flash_init() takes its own reference to the supplied fwnode and
> > v4l2_flash_release() drops that reference during device removal.
>
> How about devm_led_classdev_flash_register_ext() ?
>
> > Therefore, the reference acquired by sgm3140_probe() is only needed
> > during probe and can be released once initialization has completed.
> >
> > Drop the child node reference before returning successfully from probe.
> >
> > This issue was found by manual code inspection.
>
> I wonder what prompted you to manual inspect that code.
>
> > Fixes: cef8ec8cbd21 ("leds: add sgm3140 driver")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > ---
> >  drivers/leds/flash/leds-sgm3140.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/leds/flash/leds-sgm3140.c b/drivers/leds/flash/leds-sgm3140.c
> > index dc6840357370..51e31fdb78e5 100644
> > --- a/drivers/leds/flash/leds-sgm3140.c
> > +++ b/drivers/leds/flash/leds-sgm3140.c
> > @@ -273,7 +273,9 @@ static int sgm3140_probe(struct platform_device *pdev)
> >               goto err;
> >       }
> >
> > -     return ret;
> > +     fwnode_handle_put(child_node);
> > +
> > +     return 0;
> >
> >  err:
> >       fwnode_handle_put(child_node);
>
> --
> Regards,
>
> Laurent Pinchart

The issue I was trying to fix is that the reference obtained by
device_get_next_child_node() is not released on the successful probe
path.

I missed that devm_led_classdev_flash_register_ext() stores the fwnode
in the LED class device without taking a reference of its own. Therefore,
dropping the reference at the end of probe, as in this patch, would be
too early.

I think the reference should instead be kept until the LED class device
is unregistered. I'll rework the fix to manage it with a devm action
registered before the LED class device registration and send a v2.

Thanks,
Guangshuo

Re: [PATCH] leds: flash: sgm3140: fix child node reference leak

[Laurent Pinchart]

On Mon, Sep 21, 2026 at 04:57:30PM +0800, Guangshuo Li wrote:
> On Mon, 14 Sept 2026 at 22:17, Laurent Pinchart wrote:
> > On Mon, Sep 14, 2026 at 09:57:23PM +0800, Guangshuo Li wrote:
> > > sgm3140_probe() obtains a reference to the LED child node with
> > > device_get_next_child_node(). The probe error path correctly drops this
> > > reference with fwnode_handle_put(), but the successful probe path
> > > returns without releasing it.
> > >
> > > v4l2_flash_init() takes its own reference to the supplied fwnode and
> > > v4l2_flash_release() drops that reference during device removal.
> >
> > How about devm_led_classdev_flash_register_ext() ?
> >
> > > Therefore, the reference acquired by sgm3140_probe() is only needed
> > > during probe and can be released once initialization has completed.
> > >
> > > Drop the child node reference before returning successfully from probe.
> > >
> > > This issue was found by manual code inspection.
> >
> > I wonder what prompted you to manual inspect that code.
> >
> > > Fixes: cef8ec8cbd21 ("leds: add sgm3140 driver")
> > > Cc: stable@vger.kernel.org
> > > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > > ---
> > >  drivers/leds/flash/leds-sgm3140.c | 4 +++-
> > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/leds/flash/leds-sgm3140.c b/drivers/leds/flash/leds-sgm3140.c
> > > index dc6840357370..51e31fdb78e5 100644
> > > --- a/drivers/leds/flash/leds-sgm3140.c
> > > +++ b/drivers/leds/flash/leds-sgm3140.c
> > > @@ -273,7 +273,9 @@ static int sgm3140_probe(struct platform_device *pdev)
> > >               goto err;
> > >       }
> > >
> > > -     return ret;
> > > +     fwnode_handle_put(child_node);
> > > +
> > > +     return 0;
> > >
> > >  err:
> > >       fwnode_handle_put(child_node);
> 
> The issue I was trying to fix is that the reference obtained by
> device_get_next_child_node() is not released on the successful probe
> path.
> 
> I missed that devm_led_classdev_flash_register_ext() stores the fwnode
> in the LED class device without taking a reference of its own. Therefore,
> dropping the reference at the end of probe, as in this patch, would be
> too early.
> 
> I think the reference should instead be kept until the LED class device
> is unregistered. I'll rework the fix to manage it with a devm action
> registered before the LED class device registration and send a v2.

Handling this in individual drivers with a devm action seems wrong.
Please understand what you're doing and fix things correctly.

-- 
Regards,

Laurent Pinchart