From: Wentao Liang <redacted>
of_find_node_by_phandle() takes a reference on the GPR node and the error
path releases it through out_put_nodeq. The success path returns before
reaching that label, so the reference is leaked every time the stop mode is
set up successfully, and the node can never be freed.
Release the node reference before returning.
Fixes: e9f2a856e102 ("can: flexcan: fix an use-after-free in flexcan_setup_stop_mode()")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <redacted>
Link: https://patch.msgid.link/20260917095302.2145506-1-vulab@iscas.ac.cn (local)
[mkl: update Fixes: tag]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/flexcan/flexcan-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/can/flexcan/flexcan-core.c b/drivers/net/can/flexcan/flexcan-core.c
index 86b40abe9e76..30ae7c344a05 100644
--- a/drivers/net/can/flexcan/flexcan-core.c
+++ b/drivers/net/can/flexcan/flexcan-core.c
@@ -1986,6 +1986,7 @@ static int flexcan_setup_stop_mode_gpr(struct platform_device *pdev)
"gpr %s req_gpr=0x02%x req_bit=%u\n",
gpr_np->full_name, priv->stm.req_gpr, priv->stm.req_bit);
+ of_node_put(gpr_np);
return 0;
out_put_node:
--
2.53.0