From: Wentao Liang of_find_node_by_phandle() takes a reference on the GPR node and the error path releases it through out_put_nodeq. The success path returns before reaching that label, so the reference is leaked every time the stop mode is set up successfully, and the node can never be freed. Release the node reference before returning. Fixes: e9f2a856e102 ("can: flexcan: fix an use-after-free in flexcan_setup_stop_mode()") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Link: https://patch.msgid.link/20260917095302.2145506-1-vulab@iscas.ac.cn [mkl: update Fixes: tag] Signed-off-by: Marc Kleine-Budde --- drivers/net/can/flexcan/flexcan-core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/can/flexcan/flexcan-core.c b/drivers/net/can/flexcan/flexcan-core.c index 86b40abe9e76..30ae7c344a05 100644 --- a/drivers/net/can/flexcan/flexcan-core.c +++ b/drivers/net/can/flexcan/flexcan-core.c @@ -1986,6 +1986,7 @@ static int flexcan_setup_stop_mode_gpr(struct platform_device *pdev) "gpr %s req_gpr=0x02%x req_bit=%u\n", gpr_np->full_name, priv->stm.req_gpr, priv->stm.req_bit); + of_node_put(gpr_np); return 0; out_put_node: -- 2.53.0