[PATCH] mtd: ubi: nvmem: Fix device_node leak in ubi_nvmem_add()

[PATCH] mtd: ubi: nvmem: Fix device_node leak in ubi_nvmem_add()

[Vishal Satle]

ubi_nvmem_add() calls of_get_child_by_name() to verify that the UBI
volume device node contains an "nvmem-layout" subnode.
of_get_child_by_name() returns a pointer to the child device_node
with its reference count incremented.

Because the returned pointer was only evaluated as a boolean condition
and not retained or put, the reference count of the "nvmem-layout" node
was leaked whenever an NVMEM-enabled UBI volume was registered.

Assign the child node to a local variable and release it with
of_node_put() once existence has been validated.

Fixes: 34a5d8525b6a ("mtd: ubi: add NVMEM support")
Cc: stable@vger.kernel.org
Signed-off-by: Vishal Satle <vishalsatleit24@gmail.com>
---
 drivers/mtd/ubi/nvmem.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/ubi/nvmem.c b/drivers/mtd/ubi/nvmem.c
index 2dade9727..15737d511 100644
--- a/drivers/mtd/ubi/nvmem.c
+++ b/drivers/mtd/ubi/nvmem.c
@@ -61,6 +61,7 @@ static int ubi_nvmem_reg_read(void *priv, unsigned int from,
 static int ubi_nvmem_add(struct ubi_volume_info *vi)
 {
 	struct device_node *np = dev_of_node(vi->dev);
+	struct device_node *layout;
 	struct nvmem_config config = {};
 	struct ubi_nvmem *unv;
 	int ret;
@@ -68,9 +69,12 @@ static int ubi_nvmem_add(struct ubi_volume_info *vi)
 	if (!np)
 		return 0;
 
-	if (!of_get_child_by_name(np, "nvmem-layout"))
+	layout = of_get_child_by_name(np, "nvmem-layout");
+	if (!layout)
 		return 0;
 
+	of_node_put(layout);
+
 	if (WARN_ON_ONCE(vi->usable_leb_size <= 0) ||
 	    WARN_ON_ONCE(vi->size <= 0))
 		return -EINVAL;
-- 
2.51.0

Re: [PATCH] mtd: ubi: nvmem: Fix device_node leak in ubi_nvmem_add()

[Daniel Golle]

On Tue, Oct 27, 2026 at 02:45:07PM +0530, Vishal Satle wrote:
> ubi_nvmem_add() calls of_get_child_by_name() to verify that the UBI
> volume device node contains an "nvmem-layout" subnode.
> of_get_child_by_name() returns a pointer to the child device_node
> with its reference count incremented.
> 
> Because the returned pointer was only evaluated as a boolean condition
> and not retained or put, the reference count of the "nvmem-layout" node
> was leaked whenever an NVMEM-enabled UBI volume was registered.
> 
> Assign the child node to a local variable and release it with
> of_node_put() once existence has been validated.
> 
> Fixes: 34a5d8525b6a ("mtd: ubi: add NVMEM support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Vishal Satle <vishalsatleit24@gmail.com>

Thanks for fixing this.

Reviewed-by: Daniel Golle <daniel@makrotopia.org>

Re: [PATCH] mtd: ubi: nvmem: Fix device_node leak in ubi_nvmem_add()

[Zhihao Cheng]

在 2026/10/27 17:15, Vishal Satle 写道:
> ubi_nvmem_add() calls of_get_child_by_name() to verify that the UBI
> volume device node contains an "nvmem-layout" subnode.
> of_get_child_by_name() returns a pointer to the child device_node
> with its reference count incremented.
> 
> Because the returned pointer was only evaluated as a boolean condition
> and not retained or put, the reference count of the "nvmem-layout" node
> was leaked whenever an NVMEM-enabled UBI volume was registered.
> 
> Assign the child node to a local variable and release it with
> of_node_put() once existence has been validated.
> 
> Fixes: 34a5d8525b6a ("mtd: ubi: add NVMEM support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Vishal Satle <vishalsatleit24@gmail.com>
> ---
>   drivers/mtd/ubi/nvmem.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)

Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
> 
> diff --git a/drivers/mtd/ubi/nvmem.c b/drivers/mtd/ubi/nvmem.c
> index 2dade9727..15737d511 100644
> --- a/drivers/mtd/ubi/nvmem.c
> +++ b/drivers/mtd/ubi/nvmem.c
> @@ -61,6 +61,7 @@ static int ubi_nvmem_reg_read(void *priv, unsigned int from,
>   static int ubi_nvmem_add(struct ubi_volume_info *vi)
>   {
>   	struct device_node *np = dev_of_node(vi->dev);
> +	struct device_node *layout;
>   	struct nvmem_config config = {};
>   	struct ubi_nvmem *unv;
>   	int ret;
> @@ -68,9 +69,12 @@ static int ubi_nvmem_add(struct ubi_volume_info *vi)
>   	if (!np)
>   		return 0;
>   
> -	if (!of_get_child_by_name(np, "nvmem-layout"))
> +	layout = of_get_child_by_name(np, "nvmem-layout");
> +	if (!layout)
>   		return 0;
>   
> +	of_node_put(layout);
> +
>   	if (WARN_ON_ONCE(vi->usable_leb_size <= 0) ||
>   	    WARN_ON_ONCE(vi->size <= 0))
>   		return -EINVAL;
>