On Tue, Oct 28, 2025 at 7:08 AM Miaoqian Lin linmq006@gmail.com wrote:

In thermal_of_cm_lookup(), of_parse_phandle() returns a device node with its reference count incremented. The caller is responsible for releasing this reference when the node is no longer needed.

Add of_node_put(tr_np) to fix the reference leaks.

Found via static analysis.

Fixes: 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin linmq006@gmail.com

---

drivers/thermal/thermal_of.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c index 1a51a4d240ff..2bb1b8e471cf 100644 --- a/drivers/thermal/thermal_of.c +++ b/drivers/thermal/thermal_of.c @@ -284,8 +284,11 @@ static bool thermal_of_cm_lookup(struct device_node *cm_np, int count, i;

            tr_np = of_parse_phandle(child, "trip", 0);

•           if (tr_np != trip->priv)
  

•           if (tr_np != trip->priv) {
  

•                   of_node_put(tr_np);
                    continue;
  

•           }
  

•           of_node_put(tr_np);
  

This will also work because tr_np is not dereferenced below:

tr_np = of_parse_phandle(child, "trip", 0); of_node_put(tr_np); if (tr_np != trip->priv) continue;

but a more general question is whether or not device nodes used for populating thermal zone trip points can be let go.

If not, then this change needs to be combined with another one that will prevent them from going away.

Presumably they need to be reference counted in thermal_of_populate_trip(). Daniel?

            /* The trip has been found, look up the cdev. */
            count = of_count_phandle_with_args(child, "cooling-device",

--