pinctrl: samsung: Fix device node refcount leaks in init code

commit a322b3377f4bac32aa25fb1acb9e7afbbbbd0137 upstream.

Several functions use for_each_child_of_node() loop with a break to find
a matching child node.  Although each iteration of
for_each_child_of_node puts the previous node, but early exit from loop
misses it.  This leads to leak of device node.

Cc: <stable@vger.kernel.org>
Fixes: 9a2c1c3b91aa ("pinctrl: samsung: Allow grouping multiple pinmux/pinconf nodes")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index 620727f..6b77a1b 100644 (file)
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -281,6 +281,7 @@ static int samsung_dt_node_to_map(struct pinctrl_dev *pctldev,
                                                &reserved_maps, num_maps);
                if (ret < 0) {
                        samsung_dt_free_map(pctldev, *map, *num_maps);
+                       of_node_put(np);
                        return ret;
                }
        }
@@ -770,8 +771,10 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions(
                if (!of_get_child_count(cfg_np)) {
                        ret = samsung_pinctrl_create_function(dev, drvdata,
                                                        cfg_np, func);
-                       if (ret < 0)
+                       if (ret < 0) {
+                               of_node_put(cfg_np);
                                return ERR_PTR(ret);
+                       }
                        if (ret > 0) {
                                ++func;
                                ++func_cnt;
@@ -782,8 +785,11 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions(
                for_each_child_of_node(cfg_np, func_np) {
                        ret = samsung_pinctrl_create_function(dev, drvdata,
                                                func_np, func);
-                       if (ret < 0)
+                       if (ret < 0) {
+                               of_node_put(func_np);
+                               of_node_put(cfg_np);
                                return ERR_PTR(ret);
+                       }
                        if (ret > 0) {
                                ++func;
                                ++func_cnt;