[PATCH] mtd: retain the partition node reference across device registration

[PATCH] mtd: retain the partition node reference across device registration

[James Hilliard]

mtd_check_of_node() obtains a child node reference while looking up a
partition, stores the node in the MTD device, and drops the reference.
add_mtd_device() only takes its own reference after the helper returns.
A concurrent dynamic DT removal can release the node in that gap.

Return a referenced node from the lookup helper and transfer that reference
to the MTD device. For an already supplied node, acquire the reference in
the same helper. The existing registration unwind and device release paths
remain responsible for putting it.

Fixes: ad9b10d1eaad ("mtd: core: introduce of support for dynamic partitions")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
 drivers/mtd/mtdcore.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 491a27d0315f..f7fa895ede35 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -636,7 +636,7 @@ static int mtd_nvmem_add(struct mtd_info *mtd)
 	return 0;
 }
 
-static void mtd_check_of_node(struct mtd_info *mtd)
+static struct device_node *mtd_find_of_node(struct mtd_info *mtd)
 {
 	struct device_node *partitions, *parent_dn, *mtd_dn = NULL;
 	const char *pname, *prefix = "partition-";
@@ -644,14 +644,14 @@ static void mtd_check_of_node(struct mtd_info *mtd)
 
 	/* Check if MTD already has a device node */
 	if (mtd_get_of_node(mtd))
-		return;
+		return of_node_get(mtd_get_of_node(mtd));
 
 	if (!mtd_is_partition(mtd))
-		return;
+		return NULL;
 
 	parent_dn = of_node_get(mtd_get_of_node(mtd->parent));
 	if (!parent_dn)
-		return;
+		return NULL;
 
 	if (mtd_is_partition(mtd->parent))
 		partitions = of_node_get(parent_dn);
@@ -679,16 +679,14 @@ static void mtd_check_of_node(struct mtd_info *mtd)
 
 		plen = strlen(pname) - offset;
 		if (plen == mtd_name_len &&
-		    !strncmp(mtd->name, pname + offset, plen)) {
-			mtd_set_of_node(mtd, mtd_dn);
-			of_node_put(mtd_dn);
+		    !strncmp(mtd->name, pname + offset, plen))
 			break;
-		}
 	}
 
 	of_node_put(partitions);
 exit_parent:
 	of_node_put(parent_dn);
+	return mtd_dn;
 }
 
 /**
@@ -805,8 +803,7 @@ int add_mtd_device(struct mtd_info *mtd)
 	if (error)
 		goto fail_devname;
 	dev_set_drvdata(&mtd->dev, mtd);
-	mtd_check_of_node(mtd);
-	of_node_get(mtd_get_of_node(mtd));
+	mtd_set_of_node(mtd, mtd_find_of_node(mtd));
 	error = device_register(&mtd->dev);
 	if (error)
 		goto fail_added;

---
base-commit: 1c1a342aceec79528b3ba51f376eca2be5928fe7
change-id: 20261107-submit-mtd-partition-node-reference-v1-99ecfce4b351

Best regards,
--  
James Hilliard <james.hilliard1@gmail.com>


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH] mtd: retain the partition node reference across device registration

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] mtd: incorrect Fixes trailer commit in mtd_find_of_node() change
--

commit 43323e99a46a84cff0195c53099ca6a7a7215432
Author: James Hilliard <james.hilliard1@gmail.com>

> mtd: retain the partition node reference across device registration
>
> mtd_check_of_node() obtains a child node reference while looking up a
> partition, stores the node in the MTD device, and drops the reference.
> add_mtd_device() only takes its own reference after the helper returns.
> A concurrent dynamic DT removal can release the node in that gap.
>
> Return a referenced node from the lookup helper and transfer that reference
> to the MTD device. For an already supplied node, acquire the reference in
> the same helper. The existing registration unwind and device release paths
> remain responsible for putting it.
>
> Fixes: ad9b10d1eaad ("mtd: core: introduce of support for dynamic partitions")
> Cc: stable@vger.kernel.org
> Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

[Severity: Low]
Should the Fixes: tag point to 5ab9bbf6c678 ("mtd: Fix possible refcounting
issue when going through partition nodes") instead?

Commit ad9b10d1eaad ("mtd: core: introduce of support for dynamic
partitions") broke out of for_each_child_of_node() without calling
of_node_put(mtd_dn), keeping the reference held across the return to
add_mtd_device().  Commit 5ab9bbf6c678 ("mtd: Fix possible refcounting issue
when going through partition nodes") added the of_node_put(mtd_dn) call in
mtd_check_of_node(), creating the window where the reference is dropped
before add_mtd_device() calls of_node_get().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-submit-mtd-partition-node-reference-v1-v1-1-ad30359569d4@gmail.com?part=1

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/