qcom_smd_parse_edge() stores an extra reference to the edge's device node in edge->of_node, and it is used after probe by qcom_smd_match_channel(). The error path drops that reference, but the success path does not, and qcom_smd_edge_release() only frees the edge, so the reference is leaked when the edge is unregistered. Release the device node when the edge is freed. Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/rpmsg/qcom_smd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c index 3ac863f400ec..d98e8bbf9bd2 100644 --- a/drivers/rpmsg/qcom_smd.c +++ b/drivers/rpmsg/qcom_smd.c @@ -1452,6 +1452,7 @@ static void qcom_smd_edge_release(struct device *dev) kfree(channel); } + of_node_put(edge->of_node); kfree(edge); } -- 2.34.1