[PATCH] mtd: rawnand: intel: fix OF node reference leak

[PATCH] mtd: rawnand: intel: fix OF node reference leak

[Guangshuo Li]

ebu_nand_probe() gets a reference to the NAND chip node with
of_get_next_child(). The probe failure paths release the reference with
of_node_put(), but the successful probe path keeps it for the lifetime
of the device and ebu_nand_remove() never drops it.

As a result, each bind/unbind cycle leaks a reference to the NAND chip
device node.

Drop the reference in ebu_nand_remove() after the NAND teardown using
the flash node stored in the NAND chip.

This issue was found by manual code inspection.

Fixes: bfc618fcc3f1 ("mtd: rawnand: intel: Read the chip-select line from the correct OF node")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/mtd/nand/raw/intel-nand-controller.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c
index 01cefdaf115d..9f3e3a6cec71 100644
--- a/drivers/mtd/nand/raw/intel-nand-controller.c
+++ b/drivers/mtd/nand/raw/intel-nand-controller.c
@@ -711,6 +711,7 @@ static int ebu_nand_probe(struct platform_device *pdev)
 static void ebu_nand_remove(struct platform_device *pdev)
 {
 	struct ebu_nand_controller *ebu_host = platform_get_drvdata(pdev);
+	struct device_node *chip_np = nand_get_flash_node(&ebu_host->chip);
 	int ret;
 
 	ret = mtd_device_unregister(nand_to_mtd(&ebu_host->chip));
@@ -718,6 +719,7 @@ static void ebu_nand_remove(struct platform_device *pdev)
 	nand_cleanup(&ebu_host->chip);
 	ebu_nand_disable(&ebu_host->chip);
 	ebu_dma_cleanup(ebu_host);
+	of_node_put(chip_np);
 }
 
 static const struct of_device_id ebu_nand_match[] = {
-- 
2.43.0

Re: [PATCH] mtd: rawnand: intel: fix OF node reference leak

[Miquel Raynal]

On 16/09/2026 at 00:34:07 +08, Guangshuo Li <lgs201920130244@gmail.com> wrote:

> ebu_nand_probe() gets a reference to the NAND chip node with
> of_get_next_child(). The probe failure paths release the reference with
> of_node_put(), but the successful probe path keeps it for the lifetime
> of the device and ebu_nand_remove() never drops it.
>
> As a result, each bind/unbind cycle leaks a reference to the NAND chip
> device node.
>
> Drop the reference in ebu_nand_remove() after the NAND teardown using
> the flash node stored in the NAND chip.
>
> This issue was found by manual code inspection.

Feels like what you say is not what you do. Please align the code or the
commit log with your real intention.

> Fixes: bfc618fcc3f1 ("mtd: rawnand: intel: Read the chip-select line from the correct OF node")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

Thanks,
Miquèl