[PATCH] soc: dove: pmu: fix device_node refcount leaks in dove_init_pmu()

[Weigang He]

dove_init_pmu() acquires two device_node references that are leaked on
several exit paths:

  - np_pmu, from of_find_compatible_node(): leaked on the !domains_node
    early return and on the !pmu allocation-failure return, both of which
    occur before the reference is handed to pmu->of_node. On the iomap
    failure path it has already been stored in pmu->of_node, so it must
    be released via that field before pmu is freed.

  - domains_node, from of_get_child_by_name(): used only as the iterator
    base of for_each_available_child_of_node(), which never drops the
    parent reference. It is leaked on the allocation-failure return, the
    iomap-failure return and, most commonly, on the normal success path.

The success path keeps np_pmu alive deliberately: it is stored in
pmu->of_node and the pmu structure persists for the lifetime of the
system, so np_pmu is not put there.

Release np_pmu on the two early error returns and via pmu->of_node on the
iomap-failure return, and release domains_node on every path once it is
no longer needed.

Found by static analysis tool CodeQL.

Fixes: 44e259ac909f ("ARM: dove: create a proper PMU driver for power domains, PMU IRQs and resets")
Signed-off-by: Weigang He <geoffreyhe2 at gmail.com>
---
 drivers/soc/dove/pmu.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/dove/pmu.c b/drivers/soc/dove/pmu.c
index 7bbd3f940e4d9..d8819ad50db5f 100644
--- a/drivers/soc/dove/pmu.c
+++ b/drivers/soc/dove/pmu.c
@@ -383,12 +383,16 @@ int __init dove_init_pmu(void)
 	domains_node = of_get_child_by_name(np_pmu, "domains");
 	if (!domains_node) {
 		pr_err("%pOFn: failed to find domains sub-node\n", np_pmu);
+		of_node_put(np_pmu);
 		return 0;
 	}
 
 	pmu = kzalloc(sizeof(*pmu), GFP_KERNEL);
-	if (!pmu)
+	if (!pmu) {
+		of_node_put(np_pmu);
+		of_node_put(domains_node);
 		return -ENOMEM;
+	}
 
 	spin_lock_init(&pmu->lock);
 	pmu->of_node = np_pmu;
@@ -398,7 +402,9 @@ int __init dove_init_pmu(void)
 		pr_err("%pOFn: failed to map PMU\n", np_pmu);
 		iounmap(pmu->pmu_base);
 		iounmap(pmu->pmc_base);
+		of_node_put(pmu->of_node);
 		kfree(pmu);
+		of_node_put(domains_node);
 		return -ENOMEM;
 	}
 
@@ -443,6 +449,8 @@ int __init dove_init_pmu(void)
 		__pmu_domain_register(domain, np);
 	}
 
+	of_node_put(domains_node);
+
 	/* Loss of the interrupt controller is not a fatal error. */
 	parent_irq = irq_of_parse_and_map(pmu->of_node, 0);
 	if (!parent_irq) {

base-commit: 0f61b1860cc3f52aef9036d7235ed1f017632193
-- 
2.43.0