Re: [PATCH] extcon: rtk-type-c, ptn5150: fix connector fwnode_handle leaks

[Krzysztof Kozlowski <krzk@kernel.org>]

On 25/10/2026 21:31, Selby Mashiki wrote:
> In extcon_rtk_type_c_init(), device_get_named_child_node(dev, "connector")
> acquires a reference to the connector fwnode_handle that is never released
> on any return path.
> 
> Similarly, in ptn5150_i2c_probe(), device_get_named_child_node(dev,
> "connector") acquires a reference to connector that is passed to
> fwnode_typec_switch_get() and fwnode_usb_role_switch_get() and then leaked
> when the function returns.
> 
> Mark both variables with __free(fwnode_handle) so the references are
> automatically released on scope exit.
> 
> Fixes: 8a590d7371f0 ("extcon: add Realtek DHC RTD SoC Type-C driver")
> Fixes: 842546c56345 ("extcon: ptn5150: Add Type-C orientation switch support")
> Signed-off-by: Selby Mashiki <mashikiselby@gmail.com>
> ---
>  drivers/extcon/extcon-ptn5150.c    |  2 +-
>  drivers/extcon/extcon-rtk-type-c.c | 10 +++++-----
>  2 files changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/extcon/extcon-ptn5150.c b/drivers/extcon/extcon-ptn5150.c
> index eca1b140a..b5e1a3f3d 100644
> --- a/drivers/extcon/extcon-ptn5150.c
> +++ b/drivers/extcon/extcon-ptn5150.c
> @@ -256,7 +256,7 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c)
>  {
>  	struct device *dev = &i2c->dev;
>  	struct device_node *np = i2c->dev.of_node;
> -	struct fwnode_handle *connector;
> +	struct fwnode_handle *connector __free(fwnode_handle) = NULL;

Why is the constructor empty? I cannot find any multi-assignment, which
would lead to exceptions. Did you read description of cleanup usage?

>  	struct ptn5150_info *info;
>  	int ret;
>  
> diff --git a/drivers/extcon/extcon-rtk-type-c.c b/drivers/extcon/extcon-rtk-type-c.c
> index 82b60b927..4b1fc084f 100644
> --- a/drivers/extcon/extcon-rtk-type-c.c
> +++ b/drivers/extcon/extcon-rtk-type-c.c
> @@ -1236,20 +1236,20 @@ static int extcon_rtk_type_c_init(struct type_c_data *type_c)
>  	schedule_delayed_work(&type_c->delayed_work, msecs_to_jiffies(0));
>  
>  	if (!type_c->port) {
> +		struct fwnode_handle *fwnode __free(fwnode_handle) =
> +			device_get_named_child_node(dev, "connector");

This is odd. Why do you move it to the top?

>  		struct typec_capability typec_cap = { };
> -		struct fwnode_handle *fwnode;
>  		const char *buf;
>  		int ret;
>  
> +		if (!fwnode)

Here is the usage.

> +			return -EINVAL;
> +

cleanup.h is not always making code readable, so please avoid it if you
do not intend to read its description how it supposed to be used.

Best regards,
Krzysztof