[PATCH] mtd: hyperbus: rpc-if: fix an OF node reference leak

[PATCH] mtd: hyperbus: rpc-if: fix an OF node reference leak

[Yige Jiang]

rpcif_hb_probe() gets a child-node reference with of_get_next_child().
The HyperBus core does not consume it, so the driver leaks the
reference on registration failure and remove.

Put the node on registration failure and after unregistering the
HyperBus device on remove. Leave hardware initialization failures on
out_disable_rpm, since no node reference has been acquired there.

Fixes: 5de15b610f78 ("mtd: hyperbus: add Renesas RPC-IF driver")
Assisted-by: LLM
Signed-off-by: Yige Jiang <yigejiang86@gmail.com>
---
Based on linux-next next-20261016 (2efb7a11f1aa).
Compile-tested: arm64, GCC 14.2.0, W=1, CONFIG_OF_DYNAMIC=y.
COMPILE_TEST=y.
The object was built from this exact base with the patch applied.
No full kernel or module-link, hardware or runtime test was performed.

 drivers/mtd/hyperbus/rpc-if.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/hyperbus/rpc-if.c b/drivers/mtd/hyperbus/rpc-if.c
index f448e23f9260f10abe17842849b312365dcd8294..aa69abe6d6bc674bb8cdb531bbadfb7b356e3123 100644
--- a/drivers/mtd/hyperbus/rpc-if.c
+++ b/drivers/mtd/hyperbus/rpc-if.c
@@ -145,10 +145,12 @@ static int rpcif_hb_probe(struct platform_device *pdev)
 	hyperbus->hbdev.np = of_get_next_child(pdev->dev.parent->of_node, NULL);
 	error = hyperbus_register_device(&hyperbus->hbdev);
 	if (error)
-		goto out_disable_rpm;
+		goto out_put_node;
 
 	return 0;
 
+out_put_node:
+	of_node_put(hyperbus->hbdev.np);
 out_disable_rpm:
 	pm_runtime_disable(hyperbus->rpc.dev);
 	return error;
@@ -161,6 +163,7 @@ static void rpcif_hb_remove(struct platform_device *pdev)
 	hyperbus_unregister_device(&hyperbus->hbdev);
 
 	pm_runtime_disable(hyperbus->rpc.dev);
+	of_node_put(hyperbus->hbdev.np);
 }
 
 static const struct platform_device_id rpc_if_hyperflash_id_table[] = {

base-commit: 2efb7a11f1aa4d2dc285fe2680cca22cb9f72f64

Re: [PATCH] mtd: hyperbus: rpc-if: fix an OF node reference leak

[Miquel Raynal]

On 29/10/2026 at 00:47:40 +08, Yige Jiang <yigejiang86@gmail.com> wrote:

> rpcif_hb_probe() gets a child-node reference with of_get_next_child().
> The HyperBus core does not consume it, so the driver leaks the
> reference on registration failure and remove.
>
> Put the node on registration failure and after unregistering the
> HyperBus device on remove. Leave hardware initialization failures on
> out_disable_rpm, since no node reference has been acquired there.
>
> Fixes: 5de15b610f78 ("mtd: hyperbus: add Renesas RPC-IF driver")
> Assisted-by: LLM
> Signed-off-by: Yige Jiang <yigejiang86@gmail.com>
> ---
> Based on linux-next next-20261016 (2efb7a11f1aa).
> Compile-tested: arm64, GCC 14.2.0, W=1, CONFIG_OF_DYNAMIC=y.
> COMPILE_TEST=y.
> The object was built from this exact base with the patch applied.
> No full kernel or module-link, hardware or runtime test was performed.
>
>  drivers/mtd/hyperbus/rpc-if.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/mtd/hyperbus/rpc-if.c b/drivers/mtd/hyperbus/rpc-if.c
> index f448e23f9260f10abe17842849b312365dcd8294..aa69abe6d6bc674bb8cdb531bbadfb7b356e3123 100644
> --- a/drivers/mtd/hyperbus/rpc-if.c
> +++ b/drivers/mtd/hyperbus/rpc-if.c
> @@ -145,10 +145,12 @@ static int rpcif_hb_probe(struct platform_device *pdev)
>  	hyperbus->hbdev.np = of_get_next_child(pdev->dev.parent->of_node, NULL);
>  	error = hyperbus_register_device(&hyperbus->hbdev);
>  	if (error)
> -		goto out_disable_rpm;
> +		goto out_put_node;
>  
>  	return 0;
>  
> +out_put_node:
> +	of_node_put(hyperbus->hbdev.np);
>  out_disable_rpm:
>  	pm_runtime_disable(hyperbus->rpc.dev);
>  	return error;
> @@ -161,6 +163,7 @@ static void rpcif_hb_remove(struct platform_device *pdev)
>  	hyperbus_unregister_device(&hyperbus->hbdev);
>  
>  	pm_runtime_disable(hyperbus->rpc.dev);
> +	of_node_put(hyperbus->hbdev.np);
>  }
>  

In general we always apply the same order in the probe error path and in
the remove path. This is not respected here?

Thanks,
Miquèl