[PATCH] fsi: aspeed: fix memory leak on remove

[PATCH] fsi: aspeed: fix memory leak on remove

[Guangshuo Li]

fsi_master_aspeed_probe() takes an extra reference to master.dev with
get_device() after registering the FSI master so that the aspeed object
remains valid while the remove path performs its cleanup.

However, fsi_master_aspeed_remove() never drops this extra reference.
After fsi_master_unregister() releases the reference held by device
registration, the extra reference remains and prevents the device
release callback from being invoked. As a result,
aspeed_master_release() is never called and the fsi_master_aspeed
object is leaked.

Drop the extra device reference with put_device() after the clock has
been disabled. This allows the reference count to reach zero and
aspeed_master_release() to free the aspeed object.

This issue was found by manual code inspection.

Fixes: 606397d67f41 ("fsi: Add ast2600 master driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/fsi/fsi-master-aspeed.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
index aa1380cdff33..d21d06b44350 100644
--- a/drivers/fsi/fsi-master-aspeed.c
+++ b/drivers/fsi/fsi-master-aspeed.c
@@ -652,6 +652,7 @@ static void fsi_master_aspeed_remove(struct platform_device *pdev)
 
 	fsi_master_unregister(&aspeed->master);
 	clk_disable_unprepare(aspeed->clk);
+	put_device(&aspeed->master.dev);
 }
 
 static const struct of_device_id fsi_master_aspeed_match[] = {
-- 
2.43.0

[PATCH] fsi: master-aspeed: Fix of_node reference leak in fsi_master_aspeed_probe()

[Wentao Liang]

In fsi_master_aspeed_probe(), a reference to the device tree node is
taken with of_node_get() and stored in master.dev.of_node.  If
fsi_master_register() fails, the error path frees the master without
putting that reference, leaking it.

Put the device node reference before returning on the error path.
of_node_put() tolerates a NULL node, so the earlier err_release path
via opb_readl() is unaffected.

Fixes: 606397d67f41 ("fsi: Add ast2600 master driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/fsi/fsi-master-aspeed.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
index aa1380cdff33..7c7f30c2b8e6 100644
--- a/drivers/fsi/fsi-master-aspeed.c
+++ b/drivers/fsi/fsi-master-aspeed.c
@@ -640,6 +640,7 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
 	return 0;
 
 err_release:
+	of_node_put(aspeed->master.dev.of_node);
 	clk_disable_unprepare(aspeed->clk);
 err_free_aspeed:
 	kfree(aspeed);
-- 
2.34.1

Re: [PATCH] fsi: master-aspeed: Fix of_node reference leak in fsi_master_aspeed_probe()

[Greg KH]

On Wed, Sep 16, 2026 at 09:39:14AM +0000, Wentao Liang wrote:
> In fsi_master_aspeed_probe(), a reference to the device tree node is
> taken with of_node_get() and stored in master.dev.of_node.  If
> fsi_master_register() fails, the error path frees the master without
> putting that reference, leaking it.
> 
> Put the device node reference before returning on the error path.
> of_node_put() tolerates a NULL node, so the earlier err_release path
> via opb_readl() is unaffected.
> 
> Fixes: 606397d67f41 ("fsi: Add ast2600 master driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/fsi/fsi-master-aspeed.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
> index aa1380cdff33..7c7f30c2b8e6 100644
> --- a/drivers/fsi/fsi-master-aspeed.c
> +++ b/drivers/fsi/fsi-master-aspeed.c
> @@ -640,6 +640,7 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
>  	return 0;
>  
>  err_release:
> +	of_node_put(aspeed->master.dev.of_node);
>  	clk_disable_unprepare(aspeed->clk);
>  err_free_aspeed:
>  	kfree(aspeed);
> -- 
> 2.34.1
> 
> 

did you forget an Assisted-by: tag?

[PATCH] fsi: aspeed: release the master device node with the device

[Yige Jiang]

fsi_master_aspeed_probe() takes a node reference for master.dev.
The posted error-path fix releases it before directly freeing the
allocation, but the successful registration path still retains it
when the master device is finally released.

Put the node in aspeed_master_release() before freeing the containing
object. With the posted remove-path device put, this keeps the node
valid until the last master-device user is gone and balances the
successful path without repeating the error-path put.

Fixes: 606397d67f41 ("fsi: Add ast2600 master driver")
Link: https://patchwork.kernel.org/series/1166294/
Link: https://patchwork.kernel.org/series/1163700/
Signed-off-by: Yige Jiang <yigejiang86@gmail.com>
---
Based on linux-next next-20261102 (2637bdec0535).
Compile-tested: arm64, GCC 14.2.0, W=1, CONFIG_OF_DYNAMIC=y.
COMPILE_TEST=y.
Baseline and patched target objects built from this exact base.
No full kernel/module-link, hardware or runtime test was performed.
AI assistance was used for analysis and patch preparation.

This is an incremental patch based on the following posted fixes:
  [PATCH] fsi: master-aspeed: Fix of_node reference leak in fsi_master_aspeed_probe()
  <20260916093914.2005582-1-vulab@iscas.ac.cn>
  [PATCH] fsi: aspeed: fix memory leak on remove
  <20260913060242.1426845-1-lgs201920130244@gmail.com>

 drivers/fsi/fsi-master-aspeed.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
index f0bd760fa78b..cac0a8c73043 100644
--- a/drivers/fsi/fsi-master-aspeed.c
+++ b/drivers/fsi/fsi-master-aspeed.c
@@ -378,6 +378,7 @@ static void aspeed_master_release(struct device *dev)
 	struct fsi_master_aspeed *aspeed =
 		to_fsi_master_aspeed(to_fsi_master(dev));
 
+	of_node_put(dev->of_node);
 	kfree(aspeed);
 }
 

base-commit: 2637bdec0535a2044cd830eba9a79363651d9043
prerequisite-patch-id: 0d97a848987c2bd4195686f43f69a0d0c0f69608
prerequisite-patch-id: 00d7444e3a96e93c967d233b9c7c3a79c54647e9