[PATCH] nvmem: u-boot-env: Fix mtd reference leak in u_boot_env_probe()

[PATCH] nvmem: u-boot-env: Fix mtd reference leak in u_boot_env_probe()

[Wentao Liang]

of_get_mtd_device_by_node() takes a reference on the returned MTD device
that the caller has to drop with put_mtd_device(). The probe function
returns early when devm_nvmem_register() or u_boot_env_parse() fails
without releasing that reference, so add the missing put_mtd_device()
calls on both error paths.

Fixes: d5542923f200 ("nvmem: add driver handling U-Boot environment variables")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/nvmem/u-boot-env.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/nvmem/u-boot-env.c b/drivers/nvmem/u-boot-env.c
index ced414fc9e60..893fbd2a8520 100644
--- a/drivers/nvmem/u-boot-env.c
+++ b/drivers/nvmem/u-boot-env.c
@@ -52,6 +52,7 @@ static int u_boot_env_probe(struct platform_device *pdev)
 	struct device *dev = &pdev->dev;
 	struct device_node *np = dev->of_node;
 	struct u_boot_env *priv;
+	int ret;
 
 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
@@ -71,10 +72,16 @@ static int u_boot_env_probe(struct platform_device *pdev)
 	config.size = priv->mtd->size;
 
 	priv->nvmem = devm_nvmem_register(dev, &config);
-	if (IS_ERR(priv->nvmem))
+	if (IS_ERR(priv->nvmem)) {
+		put_mtd_device(priv->mtd);
 		return PTR_ERR(priv->nvmem);
+	}
+
+	ret = u_boot_env_parse(dev, priv->nvmem, priv->format);
+	if (ret)
+		put_mtd_device(priv->mtd);
 
-	return u_boot_env_parse(dev, priv->nvmem, priv->format);
+	return ret;
 }
 
 static const struct of_device_id u_boot_env_of_match_table[] = {
-- 
2.34.1

Re: [PATCH] nvmem: u-boot-env: Fix mtd reference leak in u_boot_env_probe()

[Srinivas Kandagatla]

On 9/17/26 1:38 PM, Wentao Liang wrote:
> of_get_mtd_device_by_node() takes a reference on the returned MTD device
> that the caller has to drop with put_mtd_device(). The probe function
> returns early when devm_nvmem_register() or u_boot_env_parse() fails
> without releasing that reference, so add the missing put_mtd_device()
> calls on both error paths.
> 
> Fixes: d5542923f200 ("nvmem: add driver handling U-Boot environment variables")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/nvmem/u-boot-env.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/nvmem/u-boot-env.c b/drivers/nvmem/u-boot-env.c
> index ced414fc9e60..893fbd2a8520 100644
> --- a/drivers/nvmem/u-boot-env.c
> +++ b/drivers/nvmem/u-boot-env.c
> @@ -52,6 +52,7 @@ static int u_boot_env_probe(struct platform_device *pdev)
>  	struct device *dev = &pdev->dev;
>  	struct device_node *np = dev->of_node;
>  	struct u_boot_env *priv;
> +	int ret;
>  
>  	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
>  	if (!priv)
> @@ -71,10 +72,16 @@ static int u_boot_env_probe(struct platform_device *pdev)
>  	config.size = priv->mtd->size;
>  
>  	priv->nvmem = devm_nvmem_register(dev, &config);
> -	if (IS_ERR(priv->nvmem))
> +	if (IS_ERR(priv->nvmem)) {
> +		put_mtd_device(priv->mtd);
>  		return PTR_ERR(priv->nvmem);
> +	}
> +
> +	ret = u_boot_env_parse(dev, priv->nvmem, priv->format);
> +	if (ret)
> +		put_mtd_device(priv->mtd);
>  
> -	return u_boot_env_parse(dev, priv->nvmem, priv->format);
> +	return ret;

consider devm_add_action_or_reset() that should cover one more case this
patch missed.

--srini
>  }
>  
>  static const struct of_device_id u_boot_env_of_match_table[] = {