Re: [PATCH] mtd: hyperbus: rpc-if: fix an OF node reference leak

[Miquel Raynal <miquel.raynal@bootlin.com>]

On 29/10/2026 at 00:47:40 +08, Yige Jiang <yigejiang86@gmail.com> wrote:

> rpcif_hb_probe() gets a child-node reference with of_get_next_child().
> The HyperBus core does not consume it, so the driver leaks the
> reference on registration failure and remove.
>
> Put the node on registration failure and after unregistering the
> HyperBus device on remove. Leave hardware initialization failures on
> out_disable_rpm, since no node reference has been acquired there.
>
> Fixes: 5de15b610f78 ("mtd: hyperbus: add Renesas RPC-IF driver")
> Assisted-by: LLM
> Signed-off-by: Yige Jiang <yigejiang86@gmail.com>
> ---
> Based on linux-next next-20261016 (2efb7a11f1aa).
> Compile-tested: arm64, GCC 14.2.0, W=1, CONFIG_OF_DYNAMIC=y.
> COMPILE_TEST=y.
> The object was built from this exact base with the patch applied.
> No full kernel or module-link, hardware or runtime test was performed.
>
>  drivers/mtd/hyperbus/rpc-if.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/mtd/hyperbus/rpc-if.c b/drivers/mtd/hyperbus/rpc-if.c
> index f448e23f9260f10abe17842849b312365dcd8294..aa69abe6d6bc674bb8cdb531bbadfb7b356e3123 100644
> --- a/drivers/mtd/hyperbus/rpc-if.c
> +++ b/drivers/mtd/hyperbus/rpc-if.c
> @@ -145,10 +145,12 @@ static int rpcif_hb_probe(struct platform_device *pdev)
>  	hyperbus->hbdev.np = of_get_next_child(pdev->dev.parent->of_node, NULL);
>  	error = hyperbus_register_device(&hyperbus->hbdev);
>  	if (error)
> -		goto out_disable_rpm;
> +		goto out_put_node;
>  
>  	return 0;
>  
> +out_put_node:
> +	of_node_put(hyperbus->hbdev.np);
>  out_disable_rpm:
>  	pm_runtime_disable(hyperbus->rpc.dev);
>  	return error;
> @@ -161,6 +163,7 @@ static void rpcif_hb_remove(struct platform_device *pdev)
>  	hyperbus_unregister_device(&hyperbus->hbdev);
>  
>  	pm_runtime_disable(hyperbus->rpc.dev);
> +	of_node_put(hyperbus->hbdev.np);
>  }
>  

In general we always apply the same order in the probe error path and in
the remove path. This is not respected here?

Thanks,
Miquèl