[PATCH] spi: mtk-snfi: fix memory leak in probe

[PATCH] spi: mtk-snfi: fix memory leak in probe

[Felix Gu]

ms->buf is allocated in mtk_snand_setup_pagefmt() but was not freed on
the following error paths.

Fixes: 2b1e19811a8e ("spi: mtk-snfi: Change default page format to setup default setting")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
---
 drivers/spi/spi-mtk-snfi.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-mtk-snfi.c b/drivers/spi/spi-mtk-snfi.c
index 73fa84475f0e..a728cf571b78 100644
--- a/drivers/spi/spi-mtk-snfi.c
+++ b/drivers/spi/spi-mtk-snfi.c
@@ -1447,14 +1447,14 @@ static int mtk_snand_probe(struct platform_device *pdev)
 	ret = nand_ecc_register_on_host_hw_engine(&ms->ecc_eng);
 	if (ret) {
 		dev_err(&pdev->dev, "failed to register ecc engine.\n");
-		goto release_ecc;
+		goto free_buf;
 	}
 
 	ret = devm_add_action_or_reset(&pdev->dev, mtk_unregister_ecc_engine,
 				       &ms->ecc_eng);
 	if (ret) {
 		dev_err_probe(&pdev->dev, ret, "failed to add ECC unregister action\n");
-		goto release_ecc;
+		goto free_buf;
 	}
 
 	ctlr->num_chipselect = 1;
@@ -1469,6 +1469,8 @@ static int mtk_snand_probe(struct platform_device *pdev)
 	}
 
 	return 0;
+free_buf:
+	kfree(ms->buf);
 release_ecc:
 	mtk_ecc_release(ms->ecc);
 	return ret;

---
base-commit: 936c21068d7ade00325e40d82bfd2f3f29d9f659
change-id: 20260415-mtk-snfi-651a984002ba

Best regards,
-- 
Felix Gu <ustc.gu@gmail.com>

Re: [PATCH] spi: mtk-snfi: fix memory leak in probe

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 703 bytes --]

On Thu, Apr 16, 2026 at 07:46:20PM +0800, Felix Gu wrote:

> ms->buf is allocated in mtk_snand_setup_pagefmt() but was not freed on
> the following error paths.

>  	ret = nand_ecc_register_on_host_hw_engine(&ms->ecc_eng);
>  	if (ret) {
>  		dev_err(&pdev->dev, "failed to register ecc engine.\n");
> -		goto release_ecc;
> +		goto free_buf;
>  	}
>  
>  	ret = devm_add_action_or_reset(&pdev->dev, mtk_unregister_ecc_engine,
>  				       &ms->ecc_eng);
>  	if (ret) {
>  		dev_err_probe(&pdev->dev, ret, "failed to add ECC unregister action\n");
> -		goto release_ecc;
> +		goto free_buf;
>  	}
>  
>  	ctlr->num_chipselect = 1;

What about spi_register_controller() failures?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]