[PATCH] soc: microchip: mpfs: Fix flash leak in mpfs_sys_controller_probe()

[PATCH] soc: microchip: mpfs: Fix flash leak in mpfs_sys_controller_probe()

[Wentao Liang]

of_get_mtd_device_by_node() returns an MTD device reference that the
caller has to drop with put_mtd_device().  The probe error paths return
without releasing it, and the reference stored in sys_controller->flash
is never dropped when the controller is destroyed either.

Release the flash on the probe error paths and in
mpfs_sys_controller_delete(), so the reference is always put.

Fixes: 742aa6c563d2 ("soc: microchip: mpfs: enable access to the system controller's flash")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/soc/microchip/mpfs-sys-controller.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/microchip/mpfs-sys-controller.c b/drivers/soc/microchip/mpfs-sys-controller.c
index 92d1142a59e6..ad57b09e5807 100644
--- a/drivers/soc/microchip/mpfs-sys-controller.c
+++ b/drivers/soc/microchip/mpfs-sys-controller.c
@@ -98,6 +98,8 @@ static void mpfs_sys_controller_delete(struct kref *kref)
 	struct mpfs_sys_controller *sys_controller =
 		container_of(kref, struct mpfs_sys_controller, consumers);
 
+	if (sys_controller->flash)
+		put_mtd_device(sys_controller->flash);
 	mbox_free_channel(sys_controller->chan);
 	kfree(sys_controller);
 }
@@ -159,7 +161,8 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
 	of_data = (struct mpfs_syscon_config *) device_get_match_data(dev);
 	if (!of_data) {
 		dev_err(dev, "Error getting match data\n");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out_free;
 	}
 
 	for (i = 0; i < of_data->nb_subdevs; i++) {
@@ -174,6 +177,10 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
 	return 0;
 
 out_free:
+	if (!IS_ERR_OR_NULL(sys_controller->flash))
+		put_mtd_device(sys_controller->flash);
+	if (!IS_ERR_OR_NULL(sys_controller->chan))
+		mbox_free_channel(sys_controller->chan);
 	kfree(sys_controller);
 	return ret;
 }
-- 
2.34.1

Re: [PATCH] soc: microchip: mpfs: Fix flash leak in mpfs_sys_controller_probe()

[Conor Dooley]

[-- Attachment #1: Type: text/plain, Size: 2769 bytes --]

On Thu, Sep 17, 2026 at 03:35:50PM +0000, Wentao Liang wrote:
> of_get_mtd_device_by_node() returns an MTD device reference that the
> caller has to drop with put_mtd_device().  The probe error paths return
> without releasing it, and the reference stored in sys_controller->flash
> is never dropped when the controller is destroyed either.
> 
> Release the flash on the probe error paths and in
> mpfs_sys_controller_delete(), so the reference is always put.

Is this diff sufficient?
If probe passes, shouldn't the driver also call this during removal?

Removal here just decrements the refcount, so the delete function is
where the call would have to go. Another patch for this driver pointed
out that the teardown code should actually call mpfs_sys_controller_put()
https://patchwork.kernel.org/project/lei-conor/patch/20260924110054.1553880-1-lgs201920130244@gmail.com/
so the right thing to do here is probably a mix of what you've got here
and what was done in that patch?

I note that the other user of this function, u-boot-env.c, doesn't call
this either.

Cheers,
Conor.

> 
> Fixes: 742aa6c563d2 ("soc: microchip: mpfs: enable access to the system controller's flash")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/soc/microchip/mpfs-sys-controller.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/soc/microchip/mpfs-sys-controller.c b/drivers/soc/microchip/mpfs-sys-controller.c
> index 92d1142a59e6..ad57b09e5807 100644
> --- a/drivers/soc/microchip/mpfs-sys-controller.c
> +++ b/drivers/soc/microchip/mpfs-sys-controller.c
> @@ -98,6 +98,8 @@ static void mpfs_sys_controller_delete(struct kref *kref)
>  	struct mpfs_sys_controller *sys_controller =
>  		container_of(kref, struct mpfs_sys_controller, consumers);
>  
> +	if (sys_controller->flash)
> +		put_mtd_device(sys_controller->flash);
>  	mbox_free_channel(sys_controller->chan);
>  	kfree(sys_controller);
>  }
> @@ -159,7 +161,8 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
>  	of_data = (struct mpfs_syscon_config *) device_get_match_data(dev);
>  	if (!of_data) {
>  		dev_err(dev, "Error getting match data\n");
> -		return -EINVAL;
> +		ret = -EINVAL;
> +		goto out_free;
>  	}
>  
>  	for (i = 0; i < of_data->nb_subdevs; i++) {
> @@ -174,6 +177,10 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
>  	return 0;
>  
>  out_free:
> +	if (!IS_ERR_OR_NULL(sys_controller->flash))
> +		put_mtd_device(sys_controller->flash);
> +	if (!IS_ERR_OR_NULL(sys_controller->chan))
> +		mbox_free_channel(sys_controller->chan);
>  	kfree(sys_controller);
>  	return ret;
>  }
> -- 
> 2.34.1
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH] soc: microchip: mpfs: Fix flash leak in mpfs_sys_controller_probe()

[Conor Dooley]

[-- Attachment #1: Type: text/plain, Size: 3203 bytes --]

On Fri, Oct 02, 2026 at 06:48:28PM +0100, Conor Dooley wrote:
> On Thu, Sep 17, 2026 at 03:35:50PM +0000, Wentao Liang wrote:
> > of_get_mtd_device_by_node() returns an MTD device reference that the
> > caller has to drop with put_mtd_device().  The probe error paths return
> > without releasing it, and the reference stored in sys_controller->flash
> > is never dropped when the controller is destroyed either.
> > 
> > Release the flash on the probe error paths and in
> > mpfs_sys_controller_delete(), so the reference is always put.
> 
> Is this diff sufficient?
> If probe passes, shouldn't the driver also call this during removal?
> 
> Removal here just decrements the refcount, so the delete function is
> where the call would have to go. Another patch for this driver pointed
> out that the teardown code should actually call mpfs_sys_controller_put()
> https://patchwork.kernel.org/project/lei-conor/patch/20260924110054.1553880-1-lgs201920130244@gmail.com/
> so the right thing to do here is probably a mix of what you've got here
> and what was done in that patch?
> 
> I note that the other user of this function, u-boot-env.c, doesn't call
> this either.

I've applied a v2 of that patch I mentioned, so I'll expect a new
iteration here on top of that:
https://patchwork.kernel.org/project/lei-conor/patch/20261007121743.192486-1-lgs201920130244@gmail.com/

Cheers,
Conor.

> 
> Cheers,
> Conor.
> 
> > 
> > Fixes: 742aa6c563d2 ("soc: microchip: mpfs: enable access to the system controller's flash")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> > ---
> >  drivers/soc/microchip/mpfs-sys-controller.c | 9 ++++++++-
> >  1 file changed, 8 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/soc/microchip/mpfs-sys-controller.c b/drivers/soc/microchip/mpfs-sys-controller.c
> > index 92d1142a59e6..ad57b09e5807 100644
> > --- a/drivers/soc/microchip/mpfs-sys-controller.c
> > +++ b/drivers/soc/microchip/mpfs-sys-controller.c
> > @@ -98,6 +98,8 @@ static void mpfs_sys_controller_delete(struct kref *kref)
> >  	struct mpfs_sys_controller *sys_controller =
> >  		container_of(kref, struct mpfs_sys_controller, consumers);
> >  
> > +	if (sys_controller->flash)
> > +		put_mtd_device(sys_controller->flash);
> >  	mbox_free_channel(sys_controller->chan);
> >  	kfree(sys_controller);
> >  }
> > @@ -159,7 +161,8 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
> >  	of_data = (struct mpfs_syscon_config *) device_get_match_data(dev);
> >  	if (!of_data) {
> >  		dev_err(dev, "Error getting match data\n");
> > -		return -EINVAL;
> > +		ret = -EINVAL;
> > +		goto out_free;
> >  	}
> >  
> >  	for (i = 0; i < of_data->nb_subdevs; i++) {
> > @@ -174,6 +177,10 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
> >  	return 0;
> >  
> >  out_free:
> > +	if (!IS_ERR_OR_NULL(sys_controller->flash))
> > +		put_mtd_device(sys_controller->flash);
> > +	if (!IS_ERR_OR_NULL(sys_controller->chan))
> > +		mbox_free_channel(sys_controller->chan);
> >  	kfree(sys_controller);
> >  	return ret;
> >  }
> > -- 
> > 2.34.1
> > 



[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH] soc: microchip: mpfs: Fix flash leak in mpfs_sys_controller_probe()

[Wentao Liang]

Hi Krzysztof, Conor,

Thank you both for the detailed review.

Sorry for the late reply, and for the mess it caused.

This is a v2 of the earlier patch, but I sent it without the v2 prefix,
without a changelog, and without referring back to Conor's review from
8 October:

  https://lore.kernel.org/all/20261008-47741881fb032091ea3d7f0c@squawk/

You are also right that the patches were sent in bulk across unrelated
subsystems, without being grouped into patchsets, without running checkpatch
on them, and without documenting what was and was not tested. I am sorry for
the extra work this has caused you.

In particular, thank you for pointing me to the kernel documentation on
subsystem identification, patchset organization and testing, and for the
guidance on how this work should be submitted. This is an important lesson
for me, and from now on I will go through all the remaining feedback
manually, one by one, and reply in a timely manner.

Going forward, I will also not send patches in large batches, so that I do
not exceed my own capacity to respond.

Best regards,
Wentao Liang

Re: [PATCH] soc: microchip: mpfs: Fix flash leak in mpfs_sys_controller_probe()

[Krzysztof Kozlowski]

On 06/11/2026 04:44, Wentao Liang wrote:
> Hi Krzysztof, Conor,
> 
> Thank you both for the detailed review.
> 
> Sorry for the late reply, and for the mess it caused.
> 
> This is a v2 of the earlier patch, but I sent it without the v2 prefix,
> without a changelog, and without referring back to Conor's review from
> 8 October:
> 
>   https://lore.kernel.org/all/20261008-47741881fb032091ea3d7f0c@squawk/
> 
> You are also right that the patches were sent in bulk across unrelated
> subsystems, without being grouped into patchsets, without running checkpatch
> on them, and without documenting what was and was not tested. I am sorry for
> the extra work this has caused you.
> 
> In particular, thank you for pointing me to the kernel documentation on
> subsystem identification, patchset organization and testing, and for the
> guidance on how this work should be submitted. This is an important lesson
> for me, and from now on I will go through all the remaining feedback
> manually, one by one, and reply in a timely manner.
> 
> Going forward, I will also not send patches in large batches, so that I do
> not exceed my own capacity to respond.

If it sends patches like a bot, if it ignored feeedback like a bot 100
times and then finally if it responds like a bot, it is probably a bot.

https://en.wikipedia.org/wiki/Duck_test

Best regards,
Krzysztof