Re: [PATCH] leds: flash: sgm3140: fix child node reference leak

[Laurent Pinchart]

On Mon, Sep 21, 2026 at 04:57:30PM +0800, Guangshuo Li wrote:
> On Mon, 14 Sept 2026 at 22:17, Laurent Pinchart wrote:
> > On Mon, Sep 14, 2026 at 09:57:23PM +0800, Guangshuo Li wrote:
> > > sgm3140_probe() obtains a reference to the LED child node with
> > > device_get_next_child_node(). The probe error path correctly drops this
> > > reference with fwnode_handle_put(), but the successful probe path
> > > returns without releasing it.
> > >
> > > v4l2_flash_init() takes its own reference to the supplied fwnode and
> > > v4l2_flash_release() drops that reference during device removal.
> >
> > How about devm_led_classdev_flash_register_ext() ?
> >
> > > Therefore, the reference acquired by sgm3140_probe() is only needed
> > > during probe and can be released once initialization has completed.
> > >
> > > Drop the child node reference before returning successfully from probe.
> > >
> > > This issue was found by manual code inspection.
> >
> > I wonder what prompted you to manual inspect that code.
> >
> > > Fixes: cef8ec8cbd21 ("leds: add sgm3140 driver")
> > > Cc: stable@xxxxxxxxxxxxxxx
> > > Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> > > ---
> > >  drivers/leds/flash/leds-sgm3140.c | 4 +++-
> > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/leds/flash/leds-sgm3140.c b/drivers/leds/flash/leds-sgm3140.c
> > > index dc6840357370..51e31fdb78e5 100644
> > > --- a/drivers/leds/flash/leds-sgm3140.c
> > > +++ b/drivers/leds/flash/leds-sgm3140.c
> > > @@ -273,7 +273,9 @@ static int sgm3140_probe(struct platform_device *pdev)
> > >               goto err;
> > >       }
> > >
> > > -     return ret;
> > > +     fwnode_handle_put(child_node);
> > > +
> > > +     return 0;
> > >
> > >  err:
> > >       fwnode_handle_put(child_node);
> 
> The issue I was trying to fix is that the reference obtained by
> device_get_next_child_node() is not released on the successful probe
> path.
> 
> I missed that devm_led_classdev_flash_register_ext() stores the fwnode
> in the LED class device without taking a reference of its own. Therefore,
> dropping the reference at the end of probe, as in this patch, would be
> too early.
> 
> I think the reference should instead be kept until the LED class device
> is unregistered. I'll rework the fix to manage it with a devm action
> registered before the LED class device registration and send a v2.

Handling this in individual drivers with a devm action seems wrong.
Please understand what you're doing and fix things correctly.

-- 
Regards,

Laurent Pinchart