Re: [PATCH] leds: flash: sgm3140: fix child node reference leak

[Guangshuo Li]

Hi Laurent,

Thanks for the review.

On Mon, 14 Sept 2026 at 22:17, Laurent Pinchart
<laurent.pinchart@xxxxxxxxxxxxxxxx> wrote:
>
> On Mon, Sep 14, 2026 at 09:57:23PM +0800, Guangshuo Li wrote:
> > sgm3140_probe() obtains a reference to the LED child node with
> > device_get_next_child_node(). The probe error path correctly drops this
> > reference with fwnode_handle_put(), but the successful probe path
> > returns without releasing it.
> >
> > v4l2_flash_init() takes its own reference to the supplied fwnode and
> > v4l2_flash_release() drops that reference during device removal.
>
> How about devm_led_classdev_flash_register_ext() ?
>
> > Therefore, the reference acquired by sgm3140_probe() is only needed
> > during probe and can be released once initialization has completed.
> >
> > Drop the child node reference before returning successfully from probe.
> >
> > This issue was found by manual code inspection.
>
> I wonder what prompted you to manual inspect that code.
>
> > Fixes: cef8ec8cbd21 ("leds: add sgm3140 driver")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> > ---
> >  drivers/leds/flash/leds-sgm3140.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/leds/flash/leds-sgm3140.c b/drivers/leds/flash/leds-sgm3140.c
> > index dc6840357370..51e31fdb78e5 100644
> > --- a/drivers/leds/flash/leds-sgm3140.c
> > +++ b/drivers/leds/flash/leds-sgm3140.c
> > @@ -273,7 +273,9 @@ static int sgm3140_probe(struct platform_device *pdev)
> >               goto err;
> >       }
> >
> > -     return ret;
> > +     fwnode_handle_put(child_node);
> > +
> > +     return 0;
> >
> >  err:
> >       fwnode_handle_put(child_node);
>
> --
> Regards,
>
> Laurent Pinchart

The issue I was trying to fix is that the reference obtained by
device_get_next_child_node() is not released on the successful probe
path.

I missed that devm_led_classdev_flash_register_ext() stores the fwnode
in the LED class device without taking a reference of its own. Therefore,
dropping the reference at the end of probe, as in this patch, would be
too early.

I think the reference should instead be kept until the LED class device
is unregistered. I'll rework the fix to manage it with a devm action
registered before the LED class device registration and send a v2.

Thanks,
Guangshuo