[PATCH] extcon: rtk-type-c, ptn5150: fix connector fwnode_handle leaks

[PATCH] extcon: rtk-type-c, ptn5150: fix connector fwnode_handle leaks

[Selby Mashiki]

In extcon_rtk_type_c_init(), device_get_named_child_node(dev, "connector")
acquires a reference to the connector fwnode_handle that is never released
on any return path.

Similarly, in ptn5150_i2c_probe(), device_get_named_child_node(dev,
"connector") acquires a reference to connector that is passed to
fwnode_typec_switch_get() and fwnode_usb_role_switch_get() and then leaked
when the function returns.

Mark both variables with __free(fwnode_handle) so the references are
automatically released on scope exit.

Fixes: 8a590d7371f0 ("extcon: add Realtek DHC RTD SoC Type-C driver")
Fixes: 842546c56345 ("extcon: ptn5150: Add Type-C orientation switch support")
Signed-off-by: Selby Mashiki <mashikiselby@gmail.com>
---
 drivers/extcon/extcon-ptn5150.c    |  2 +-
 drivers/extcon/extcon-rtk-type-c.c | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/extcon/extcon-ptn5150.c b/drivers/extcon/extcon-ptn5150.c
index eca1b140a..b5e1a3f3d 100644
--- a/drivers/extcon/extcon-ptn5150.c
+++ b/drivers/extcon/extcon-ptn5150.c
@@ -256,7 +256,7 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c)
 {
 	struct device *dev = &i2c->dev;
 	struct device_node *np = i2c->dev.of_node;
-	struct fwnode_handle *connector;
+	struct fwnode_handle *connector __free(fwnode_handle) = NULL;
 	struct ptn5150_info *info;
 	int ret;
 
diff --git a/drivers/extcon/extcon-rtk-type-c.c b/drivers/extcon/extcon-rtk-type-c.c
index 82b60b927..4b1fc084f 100644
--- a/drivers/extcon/extcon-rtk-type-c.c
+++ b/drivers/extcon/extcon-rtk-type-c.c
@@ -1236,20 +1236,20 @@ static int extcon_rtk_type_c_init(struct type_c_data *type_c)
 	schedule_delayed_work(&type_c->delayed_work, msecs_to_jiffies(0));
 
 	if (!type_c->port) {
+		struct fwnode_handle *fwnode __free(fwnode_handle) =
+			device_get_named_child_node(dev, "connector");
 		struct typec_capability typec_cap = { };
-		struct fwnode_handle *fwnode;
 		const char *buf;
 		int ret;
 
+		if (!fwnode)
+			return -EINVAL;
+
 		typec_cap.revision = USB_TYPEC_REV_1_0;
 		typec_cap.prefer_role = TYPEC_NO_PREFERRED_ROLE;
 		typec_cap.driver_data = type_c;
 		typec_cap.ops = &type_c_port_ops;
 
-		fwnode = device_get_named_child_node(dev, "connector");
-		if (!fwnode)
-			return -EINVAL;
-
 		ret = fwnode_property_read_string(fwnode, "power-role", &buf);
 		if (ret) {
 			dev_err(dev, "power-role not found: %d\n", ret);
-- 
2.56.0

Re: [PATCH] extcon: rtk-type-c, ptn5150: fix connector fwnode_handle leaks

[Krzysztof Kozlowski]

On 25/10/2026 21:31, Selby Mashiki wrote:
> In extcon_rtk_type_c_init(), device_get_named_child_node(dev, "connector")
> acquires a reference to the connector fwnode_handle that is never released
> on any return path.
> 
> Similarly, in ptn5150_i2c_probe(), device_get_named_child_node(dev,
> "connector") acquires a reference to connector that is passed to
> fwnode_typec_switch_get() and fwnode_usb_role_switch_get() and then leaked
> when the function returns.
> 
> Mark both variables with __free(fwnode_handle) so the references are
> automatically released on scope exit.
> 
> Fixes: 8a590d7371f0 ("extcon: add Realtek DHC RTD SoC Type-C driver")
> Fixes: 842546c56345 ("extcon: ptn5150: Add Type-C orientation switch support")
> Signed-off-by: Selby Mashiki <mashikiselby@gmail.com>
> ---
>  drivers/extcon/extcon-ptn5150.c    |  2 +-
>  drivers/extcon/extcon-rtk-type-c.c | 10 +++++-----
>  2 files changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/extcon/extcon-ptn5150.c b/drivers/extcon/extcon-ptn5150.c
> index eca1b140a..b5e1a3f3d 100644
> --- a/drivers/extcon/extcon-ptn5150.c
> +++ b/drivers/extcon/extcon-ptn5150.c
> @@ -256,7 +256,7 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c)
>  {
>  	struct device *dev = &i2c->dev;
>  	struct device_node *np = i2c->dev.of_node;
> -	struct fwnode_handle *connector;
> +	struct fwnode_handle *connector __free(fwnode_handle) = NULL;

Why is the constructor empty? I cannot find any multi-assignment, which
would lead to exceptions. Did you read description of cleanup usage?

>  	struct ptn5150_info *info;
>  	int ret;
>  
> diff --git a/drivers/extcon/extcon-rtk-type-c.c b/drivers/extcon/extcon-rtk-type-c.c
> index 82b60b927..4b1fc084f 100644
> --- a/drivers/extcon/extcon-rtk-type-c.c
> +++ b/drivers/extcon/extcon-rtk-type-c.c
> @@ -1236,20 +1236,20 @@ static int extcon_rtk_type_c_init(struct type_c_data *type_c)
>  	schedule_delayed_work(&type_c->delayed_work, msecs_to_jiffies(0));
>  
>  	if (!type_c->port) {
> +		struct fwnode_handle *fwnode __free(fwnode_handle) =
> +			device_get_named_child_node(dev, "connector");

This is odd. Why do you move it to the top?

>  		struct typec_capability typec_cap = { };
> -		struct fwnode_handle *fwnode;
>  		const char *buf;
>  		int ret;
>  
> +		if (!fwnode)

Here is the usage.

> +			return -EINVAL;
> +

cleanup.h is not always making code readable, so please avoid it if you
do not intend to read its description how it supposed to be used.

Best regards,
Krzysztof