Re: [PATCH] soc: microchip: mpfs: Fix flash leak in mpfs_sys_controller_probe()

[Conor Dooley <conor@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 2769 bytes --]

On Thu, Sep 17, 2026 at 03:35:50PM +0000, Wentao Liang wrote:
> of_get_mtd_device_by_node() returns an MTD device reference that the
> caller has to drop with put_mtd_device().  The probe error paths return
> without releasing it, and the reference stored in sys_controller->flash
> is never dropped when the controller is destroyed either.
> 
> Release the flash on the probe error paths and in
> mpfs_sys_controller_delete(), so the reference is always put.

Is this diff sufficient?
If probe passes, shouldn't the driver also call this during removal?

Removal here just decrements the refcount, so the delete function is
where the call would have to go. Another patch for this driver pointed
out that the teardown code should actually call mpfs_sys_controller_put()
https://patchwork.kernel.org/project/lei-conor/patch/20260924110054.1553880-1-lgs201920130244@gmail.com/
so the right thing to do here is probably a mix of what you've got here
and what was done in that patch?

I note that the other user of this function, u-boot-env.c, doesn't call
this either.

Cheers,
Conor.

> 
> Fixes: 742aa6c563d2 ("soc: microchip: mpfs: enable access to the system controller's flash")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/soc/microchip/mpfs-sys-controller.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/soc/microchip/mpfs-sys-controller.c b/drivers/soc/microchip/mpfs-sys-controller.c
> index 92d1142a59e6..ad57b09e5807 100644
> --- a/drivers/soc/microchip/mpfs-sys-controller.c
> +++ b/drivers/soc/microchip/mpfs-sys-controller.c
> @@ -98,6 +98,8 @@ static void mpfs_sys_controller_delete(struct kref *kref)
>  	struct mpfs_sys_controller *sys_controller =
>  		container_of(kref, struct mpfs_sys_controller, consumers);
>  
> +	if (sys_controller->flash)
> +		put_mtd_device(sys_controller->flash);
>  	mbox_free_channel(sys_controller->chan);
>  	kfree(sys_controller);
>  }
> @@ -159,7 +161,8 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
>  	of_data = (struct mpfs_syscon_config *) device_get_match_data(dev);
>  	if (!of_data) {
>  		dev_err(dev, "Error getting match data\n");
> -		return -EINVAL;
> +		ret = -EINVAL;
> +		goto out_free;
>  	}
>  
>  	for (i = 0; i < of_data->nb_subdevs; i++) {
> @@ -174,6 +177,10 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
>  	return 0;
>  
>  out_free:
> +	if (!IS_ERR_OR_NULL(sys_controller->flash))
> +		put_mtd_device(sys_controller->flash);
> +	if (!IS_ERR_OR_NULL(sys_controller->chan))
> +		mbox_free_channel(sys_controller->chan);
>  	kfree(sys_controller);
>  	return ret;
>  }
> -- 
> 2.34.1
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]