[PATCH] leds: lp50xx, max77705: use fwnode_for_each_child_node_scoped() to fix fwnode leaks

[PATCH] leds: lp50xx, max77705: use fwnode_for_each_child_node_scoped() to fix fwnode leaks

[Selby Mashiki]

In lp50xx_probe_dt(), the inner fwnode_for_each_child_node(child,
led_node) loop returns -EINVAL on two error paths (when reading "reg"
fails or multi_index is out of bounds) without calling
fwnode_handle_put(led_node), leaking the child reference.

Similarly, in max77705_add_led(), fwnode_for_each_child_node(np, child)
returns early when max77705_parse_subled() fails without calling
fwnode_handle_put(child).

Switch both loops to fwnode_for_each_child_node_scoped() and drop the
manual fwnode_handle_put() and loop cursor declarations so references
are automatically released on all exit paths.

Fixes: 242b81170fb8 ("leds: lp50xx: Add the LP50XX family of the RGB LED driver")
Fixes: aebb5fc9a0d8 ("leds: max77705: Add LEDs support")
Signed-off-by: Selby Mashiki <mashikiselby@gmail.com>
---
 drivers/leds/leds-lp50xx.c   | 4 +---
 drivers/leds/leds-max77705.c | 3 +--
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/leds/leds-lp50xx.c b/drivers/leds/leds-lp50xx.c
index 20bfb315b..d542eedd4 100644
--- a/drivers/leds/leds-lp50xx.c
+++ b/drivers/leds/leds-lp50xx.c
@@ -458,7 +458,6 @@ static int lp50xx_probe_leds(struct fwnode_handle *child, struct lp50xx *priv,
 
 static int lp50xx_probe_dt(struct lp50xx *priv)
 {
-	struct fwnode_handle *led_node = NULL;
 	struct led_init_data init_data = {};
 	struct led_classdev *led_cdev;
 	struct mc_subled *mc_led_info;
@@ -505,12 +504,11 @@ static int lp50xx_probe_dt(struct lp50xx *priv)
 		if (!mc_led_info)
 			return -ENOMEM;
 
-		fwnode_for_each_child_node(child, led_node) {
+		fwnode_for_each_child_node_scoped(child, led_node) {
 			int multi_index;
 			ret = fwnode_property_read_u32(led_node, "color",
 						       &color_id);
 			if (ret) {
-				fwnode_handle_put(led_node);
 				dev_err(priv->dev, "Cannot read color\n");
 				return ret;
 			}
diff --git a/drivers/leds/leds-max77705.c b/drivers/leds/leds-max77705.c
index 1e2054c1b..4fd803c95 100644
--- a/drivers/leds/leds-max77705.c
+++ b/drivers/leds/leds-max77705.c
@@ -160,7 +160,6 @@ static int max77705_add_led(struct device *dev, struct regmap *regmap, struct fw
 	struct max77705_led *led;
 	struct led_classdev *cdev;
 	struct mc_subled *info;
-	struct fwnode_handle *child;
 	struct led_init_data init_data = {};
 
 	led = devm_kzalloc(dev, sizeof(*led), GFP_KERNEL);
@@ -191,7 +190,7 @@ static int max77705_add_led(struct device *dev, struct regmap *regmap, struct fw
 		cdev->brightness_set_blocking = max77705_led_brightness_set_multi;
 		cdev->blink_set = max77705_rgb_blink;
 
-		fwnode_for_each_child_node(np, child) {
+		fwnode_for_each_child_node_scoped(np, child) {
 			ret = max77705_parse_subled(dev, child, &info[i]);
 			if (ret < 0)
 				return ret;
-- 
2.56.0

Re: [PATCH] leds: lp50xx, max77705: use fwnode_for_each_child_node_scoped() to fix fwnode leaks

[Lee Jones]

On Sun, 25 Oct 2026, Lee Jones wrote:

> On Sun, 25 Oct 2026, Selby Mashiki wrote:
> 
> > In lp50xx_probe_dt(), the inner fwnode_for_each_child_node(child,
> > led_node) loop returns -EINVAL on two error paths (when reading "reg"
> > fails or multi_index is out of bounds) without calling
> > fwnode_handle_put(led_node), leaking the child reference.
> >
> > Similarly, in max77705_add_led(), fwnode_for_each_child_node(np, child)
> > returns early when max77705_parse_subled() fails without calling
> > fwnode_handle_put(child).
> >
> > Switch both loops to fwnode_for_each_child_node_scoped() and drop the
> > manual fwnode_handle_put() and loop cursor declarations so references
> > are automatically released on all exit paths.
> >
> > Fixes: 242b81170fb8 ("leds: lp50xx: Add the LP50XX family of the RGB LED driver")
> > Fixes: aebb5fc9a0d8 ("leds: max77705: Add LEDs support")
> > Signed-off-by: Selby Mashiki <mashikiselby@gmail.com>
> > ---
> >  drivers/leds/leds-lp50xx.c   | 4 +---
> >  drivers/leds/leds-max77705.c | 3 +--
> >  2 files changed, 2 insertions(+), 5 deletions(-)

One patch per driver please.

Also, the second driver has already been fixed.  Please rebase.

> > diff --git a/drivers/leds/leds-lp50xx.c b/drivers/leds/leds-lp50xx.c
> > index 20bfb315b..d542eedd4 100644
> > --- a/drivers/leds/leds-lp50xx.c
> > +++ b/drivers/leds/leds-lp50xx.c
> > @@ -458,7 +458,6 @@ static int lp50xx_probe_leds(struct fwnode_handle *child, struct lp50xx *priv,
> >
> >  static int lp50xx_probe_dt(struct lp50xx *priv)
> >  {
> > -	struct fwnode_handle *led_node = NULL;
> >  	struct led_init_data init_data = {};
> >  	struct led_classdev *led_cdev;
> >  	struct mc_subled *mc_led_info;
> > @@ -505,12 +504,11 @@ static int lp50xx_probe_dt(struct lp50xx *priv)
> >  		if (!mc_led_info)
> >  			return -ENOMEM;
> >
> > -		fwnode_for_each_child_node(child, led_node) {
> > +		fwnode_for_each_child_node_scoped(child, led_node) {
> >  			int multi_index;
> >  			ret = fwnode_property_read_u32(led_node, "color",
> >  						       &color_id);
> >  			if (ret) {
> > -				fwnode_handle_put(led_node);
> >  				dev_err(priv->dev, "Cannot read color\n");
> >  				return ret;
> >  			}
> > diff --git a/drivers/leds/leds-max77705.c b/drivers/leds/leds-max77705.c
> > index 1e2054c1b..4fd803c95 100644
> > --- a/drivers/leds/leds-max77705.c
> > +++ b/drivers/leds/leds-max77705.c
> > @@ -160,7 +160,6 @@ static int max77705_add_led(struct device *dev, struct regmap *regmap, struct fw
> >  	struct max77705_led *led;
> >  	struct led_classdev *cdev;
> >  	struct mc_subled *info;
> > -	struct fwnode_handle *child;
> >  	struct led_init_data init_data = {};
> >
> >  	led = devm_kzalloc(dev, sizeof(*led), GFP_KERNEL);
> > @@ -191,7 +190,7 @@ static int max77705_add_led(struct device *dev, struct regmap *regmap, struct fw
> >  		cdev->brightness_set_blocking = max77705_led_brightness_set_multi;
> >  		cdev->blink_set = max77705_rgb_blink;
> >
> > -		fwnode_for_each_child_node(np, child) {
> > +		fwnode_for_each_child_node_scoped(np, child) {
> >  			ret = max77705_parse_subled(dev, child, &info[i]);
> >  			if (ret < 0)
> >  				return ret;
> > -- 
> > 2.56.0
> >
> 
> -- 
> Lee Jones

-- 
Lee Jones