sgm3140_probe() obtains a reference to the LED child node with device_get_next_child_node(). The probe error path correctly drops this reference with fwnode_handle_put(), but the successful probe path returns without releasing it. v4l2_flash_init() takes its own reference to the supplied fwnode and v4l2_flash_release() drops that reference during device removal. Therefore, the reference acquired by sgm3140_probe() is only needed during probe and can be released once initialization has completed. Drop the child node reference before returning successfully from probe. This issue was found by manual code inspection. Fixes: cef8ec8cbd21 ("leds: add sgm3140 driver") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/leds/flash/leds-sgm3140.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/leds/flash/leds-sgm3140.c b/drivers/leds/flash/leds-sgm3140.c index dc6840357370..51e31fdb78e5 100644 --- a/drivers/leds/flash/leds-sgm3140.c +++ b/drivers/leds/flash/leds-sgm3140.c @@ -273,7 +273,9 @@ static int sgm3140_probe(struct platform_device *pdev) goto err; } - return ret; + fwnode_handle_put(child_node); + + return 0; err: fwnode_handle_put(child_node); -- 2.43.0