[PATCH] pinctrl: nuvoton: fix fwnode_handle leaks in npcm7xx_gpio_of() and npcm8xx_gpio_fw()

[PATCH] pinctrl: nuvoton: fix fwnode_handle leaks in npcm7xx_gpio_of() and npcm8xx_gpio_fw()

[Selby Mashiki]

Both npcm7xx_gpio_of() and npcm8xx_gpio_fw() iterate over GPIO bank
child nodes using for_each_gpiochip_node(dev, child), which holds a
reference on child during each iteration. Returning early on any of the
error paths inside the loop leaks the child fwnode_handle reference.

Additionally, both functions call fwnode_property_get_reference_args()
to parse the "gpio-ranges" property into args, which acquires a
reference on args.fwnode that is never released.

Use the __free(fwnode_handle) cleanup attribute for child so early
returns automatically drop the reference, and call
fwnode_handle_put(args.fwnode) after fwnode_property_get_reference_args()
succeeds.

Fixes: 3b588e43ee5c ("pinctrl: nuvoton: add NPCM7xx pinctrl and GPIO driver")
Fixes: acf4884a5717 ("pinctrl: nuvoton: add NPCM8XX pinctrl and GPIO driver")
Signed-off-by: Selby Mashiki <mashikiselby@gmail.com>
---
 drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 4 +++-
 drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
index 0df749cbc..47bb642cf 100644
--- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
+++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
@@ -2,6 +2,7 @@
 // Copyright (c) 2016-2018 Nuvoton Technology corporation.
 // Copyright (c) 2016, Dell Inc
 
+#include <linux/cleanup.h>
 #include <linux/device.h>
 #include <linux/gpio/driver.h>
 #include <linux/gpio/generic.h>
@@ -1827,7 +1828,7 @@ static int npcm7xx_gpio_of(struct npcm7xx_pinctrl *pctrl)
 	int ret = -ENXIO;
 	struct device *dev = pctrl->dev;
 	struct fwnode_reference_args args;
-	struct fwnode_handle *child;
+	struct fwnode_handle *child __free(fwnode_handle) = NULL;
 	int id = 0;
 
 	for_each_gpiochip_node(dev, child) {
@@ -1855,6 +1856,7 @@ static int npcm7xx_gpio_of(struct npcm7xx_pinctrl *pctrl)
 			dev_err(dev, "gpio-ranges fail for GPIO bank %u\n", id);
 			return ret;
 		}
+		fwnode_handle_put(args.fwnode);
 
 		ret = fwnode_irq_get(child, 0);
 		if (!ret) {
diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
index a68d55cae..83e4e1511 100644
--- a/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
+++ b/drivers/pinctrl/nuvoton/pinctrl-npcm8xx.c
@@ -2,6 +2,7 @@
 // Copyright (c) 2020 Nuvoton Technology corporation.
 
 #include <linux/bits.h>
+#include <linux/cleanup.h>
 #include <linux/device.h>
 #include <linux/gpio/driver.h>
 #include <linux/gpio/generic.h>
@@ -2319,7 +2320,7 @@ static int npcm8xx_gpio_fw(struct npcm8xx_pinctrl *pctrl)
 	struct gpio_generic_chip_config config;
 	struct fwnode_reference_args args;
 	struct device *dev = pctrl->dev;
-	struct fwnode_handle *child;
+	struct fwnode_handle *child __free(fwnode_handle) = NULL;
 	int ret = -ENXIO;
 	int id = 0, i;
 
@@ -2345,6 +2346,7 @@ static int npcm8xx_gpio_fw(struct npcm8xx_pinctrl *pctrl)
 		ret = fwnode_property_get_reference_args(child, "gpio-ranges", NULL, 3, 0, &args);
 		if (ret < 0)
 			return dev_err_probe(dev, ret, "gpio-ranges fail for GPIO bank %u\n", id);
+		fwnode_handle_put(args.fwnode);
 
 		ret = fwnode_irq_get(child, 0);
 		if (ret < 0)
-- 
2.56.0

Re: [PATCH] pinctrl: nuvoton: fix fwnode_handle leaks in npcm7xx_gpio_of() and npcm8xx_gpio_fw()

[Linus Walleij]

On Sun, Oct 25, 2026 at 7:43 PM Selby Mashiki <mashikiselby@gmail.com> wrote:

> Both npcm7xx_gpio_of() and npcm8xx_gpio_fw() iterate over GPIO bank
> child nodes using for_each_gpiochip_node(dev, child), which holds a
> reference on child during each iteration. Returning early on any of the
> error paths inside the loop leaks the child fwnode_handle reference.
>
> Additionally, both functions call fwnode_property_get_reference_args()
> to parse the "gpio-ranges" property into args, which acquires a
> reference on args.fwnode that is never released.
>
> Use the __free(fwnode_handle) cleanup attribute for child so early
> returns automatically drop the reference, and call
> fwnode_handle_put(args.fwnode) after fwnode_property_get_reference_args()
> succeeds.
>
> Fixes: 3b588e43ee5c ("pinctrl: nuvoton: add NPCM7xx pinctrl and GPIO driver")
> Fixes: acf4884a5717 ("pinctrl: nuvoton: add NPCM8XX pinctrl and GPIO driver")
> Signed-off-by: Selby Mashiki <mashikiselby@gmail.com>

Patch applied as nonurgent fix.

Yours,
Linus Walleij