[PATCH] spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup()

[PATCH] spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup()

[Lucas Costa]

of_find_compatible_node() returns a device_node with its reference count
incremented, but the function bcm2835_spi_setup() uses the ret value
in the loop to check a condition and never releases it.

Store the returned node and drop it with of_node_put() before breaking
out of the loop.

Fixes: e19c1272c80a ("spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent")
Cc: stable@vger.kernel.org
Signed-off-by: Lucas Costa <2000.costalucas@gmail.com>
---
 drivers/spi/spi-bcm2835.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 8f8715809c7c..8909757c94e3 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -1226,6 +1226,7 @@ static int bcm2835_spi_setup(struct spi_device *spi)
 	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
 	struct bcm2835_spidev *target = spi_get_ctldata(spi);
 	struct gpiod_lookup_table *lookup __free(kfree) = NULL;
+	struct device_node *np;
 	static const char * const pinctrl_compats[] = {
 		"brcm,bcm2835-gpio",
 		"brcm,bcm2711-gpio",
@@ -1297,8 +1298,11 @@ static int bcm2835_spi_setup(struct spi_device *spi)
 	}
 
 	for (i = 0; i < ARRAY_SIZE(pinctrl_compats); i++) {
-		if (of_find_compatible_node(NULL, NULL, pinctrl_compats[i]))
+		np = of_find_compatible_node(NULL, NULL, pinctrl_compats[i]);
+		if (np) {
+			of_node_put(np);
 			break;
+		}
 	}
 
 	if (i == ARRAY_SIZE(pinctrl_compats))
-- 
2.43.0

Re: [PATCH] spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup()

[Bartosz Golaszewski]

On Wed, 23 Sep 2026 20:44:50 +0200, Lucas Costa
<2000.costalucas@gmail.com> said:
> of_find_compatible_node() returns a device_node with its reference count
> incremented, but the function bcm2835_spi_setup() uses the ret value
> in the loop to check a condition and never releases it.
>
> Store the returned node and drop it with of_node_put() before breaking
> out of the loop.
>
> Fixes: e19c1272c80a ("spi: bcm2835: Restore native CS probing when pinctrl-bcm2835 is absent")
> Cc: stable@vger.kernel.org
> Signed-off-by: Lucas Costa <2000.costalucas@gmail.com>
> ---
>  drivers/spi/spi-bcm2835.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
> index 8f8715809c7c..8909757c94e3 100644
> --- a/drivers/spi/spi-bcm2835.c
> +++ b/drivers/spi/spi-bcm2835.c
> @@ -1226,6 +1226,7 @@ static int bcm2835_spi_setup(struct spi_device *spi)
>  	struct bcm2835_spi *bs = spi_controller_get_devdata(ctlr);
>  	struct bcm2835_spidev *target = spi_get_ctldata(spi);
>  	struct gpiod_lookup_table *lookup __free(kfree) = NULL;
> +	struct device_node *np;
>  	static const char * const pinctrl_compats[] = {
>  		"brcm,bcm2835-gpio",
>  		"brcm,bcm2711-gpio",
> @@ -1297,8 +1298,11 @@ static int bcm2835_spi_setup(struct spi_device *spi)
>  	}
>
>  	for (i = 0; i < ARRAY_SIZE(pinctrl_compats); i++) {
> -		if (of_find_compatible_node(NULL, NULL, pinctrl_compats[i]))
> +		np = of_find_compatible_node(NULL, NULL, pinctrl_compats[i]);
> +		if (np) {
> +			of_node_put(np);
>  			break;
> +		}
>  	}
>
>  	if (i == ARRAY_SIZE(pinctrl_compats))
> --
> 2.43.0
>
>

Just use cleanup.h like so:

	struct device_node *np __free(device_node) = of_find_compatible_node(...);

It's a oneliner this way.

Bart