qcom_glink_match_channel() returns a referenced child node, which
qcom_glink_rx_open() stores in rpdev->dev.of_node.
The release callback frees the rpmsg device but never drops the node
reference, so it leaks when the channel device goes away.
Drop the reference in qcom_glink_rpdev_release() before freeing the
device.
Fixes: b4f8e52b89f69 ("rpmsg: Introduce Qualcomm RPM glink driver")
Signed-off-by: Avi Weiss <[email protected]>
---
drivers/rpmsg/qcom_glink_native.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/rpmsg/qcom_glink_native.c
b/drivers/rpmsg/qcom_glink_native.c
index 55793fc18293..5142730dabc4 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1623,6 +1623,7 @@ static void qcom_glink_rpdev_release(struct device *dev)
{
struct rpmsg_device *rpdev = to_rpmsg_device(dev);
+ of_node_put(dev->of_node);
kfree(rpdev);
}
base-commit: c39c2cdbde1f2ad9e2886167e55ad6b4c4907d7f
--
2.43.0
