[PATCH] mtd: rawnand: intel: fix OF node reference leak

From: Guangshuo Li <lgs201920130244@gmail.com>
To: Miquel Raynal <miquel.raynal@bootlin.com>,
	Richard Weinberger <richard@nod.at>,
	Vignesh Raghavendra <vigneshr@ti.com>,
	Guangshuo Li <lgs201920130244@gmail.com>,
	Martin Blumenstingl <martin.blumenstingl@googlemail.com>,
	linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: [PATCH] mtd: rawnand: intel: fix OF node reference leak
Date: Wed, 16 Sep 2026 00:34:07 +0800	[thread overview]
Message-ID: <20260915163407.2487869-1-lgs201920130244@gmail.com> (raw)

ebu_nand_probe() gets a reference to the NAND chip node with
of_get_next_child(). The probe failure paths release the reference with
of_node_put(), but the successful probe path keeps it for the lifetime
of the device and ebu_nand_remove() never drops it.

As a result, each bind/unbind cycle leaks a reference to the NAND chip
device node.

Drop the reference in ebu_nand_remove() after the NAND teardown using
the flash node stored in the NAND chip.

This issue was found by manual code inspection.

Fixes: bfc618fcc3f1 ("mtd: rawnand: intel: Read the chip-select line from the correct OF node")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/mtd/nand/raw/intel-nand-controller.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c
index 01cefdaf115d..9f3e3a6cec71 100644
--- a/drivers/mtd/nand/raw/intel-nand-controller.c
+++ b/drivers/mtd/nand/raw/intel-nand-controller.c
@@ -711,6 +711,7 @@ static int ebu_nand_probe(struct platform_device *pdev)
 static void ebu_nand_remove(struct platform_device *pdev)
 {
 	struct ebu_nand_controller *ebu_host = platform_get_drvdata(pdev);
+	struct device_node *chip_np = nand_get_flash_node(&ebu_host->chip);
 	int ret;
 
 	ret = mtd_device_unregister(nand_to_mtd(&ebu_host->chip));
@@ -718,6 +719,7 @@ static void ebu_nand_remove(struct platform_device *pdev)
 	nand_cleanup(&ebu_host->chip);
 	ebu_nand_disable(&ebu_host->chip);
 	ebu_dma_cleanup(ebu_host);
+	of_node_put(chip_np);
 }
 
 static const struct of_device_id ebu_nand_match[] = {
-- 
2.43.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
