[PATCH 0/2] MTD fixes for OF node refcounting

[PATCH 0/2] MTD fixes for OF node refcounting

[Cosmin Tanislav]

This series fixes an issue observed while repeatedly binding / unbinding
the SPI controller driver to which a SPI NOR flash memory is attached,
caused by commit 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node
refcount leak in parse_fixed_partitions()"). See patch 2 for more
details.

Patch 1 is the fix for another theorethical issue I have noticed while
debugging the main issue.

Cosmin Tanislav (2):
  mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
  mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions

 drivers/mtd/parsers/ofpart_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.53.0

[PATCH 1/2] mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path

[Cosmin Tanislav]

ofpart_none can only be reached after the for_each_child_of_node() loop
finishes. for_each_child_of_node() correctly calls of_node_put() for all
device nodes it iterates over as long as we don't break or jump out of
the loop.

Calling of_node_put() inside the ofpart_none path will wrongly decrement
the ref count of the last node in the for_each_child_of_node() loop.

Move the call to of_node_put() under the ofpart_fail label to fix this.

Fixes: ebd5a74db74e ("mtd: ofpart: Check availability of reg property instead of name property")
Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
---
 drivers/mtd/parsers/ofpart_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/parsers/ofpart_core.c b/drivers/mtd/parsers/ofpart_core.c
index 0029bda165bd..181ae9616b2e 100644
--- a/drivers/mtd/parsers/ofpart_core.c
+++ b/drivers/mtd/parsers/ofpart_core.c
@@ -195,11 +195,11 @@ static int parse_fixed_partitions(struct mtd_info *master,
 ofpart_fail:
 	pr_err("%s: error parsing ofpart partition %pOF (%pOF)\n",
 	       master->name, pp, mtd_node);
+	of_node_put(pp);
 	ret = -EINVAL;
 ofpart_none:
 	if (dedicated)
 		of_node_put(ofpart_node);
-	of_node_put(pp);
 	kfree(parts);
 	return ret;
 }
-- 
2.53.0

Re: [PATCH 1/2] mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path

[Tommaso Merciai]

On Wed, Mar 11, 2026 at 05:39:56PM +0200, Cosmin Tanislav wrote:
> ofpart_none can only be reached after the for_each_child_of_node() loop
> finishes. for_each_child_of_node() correctly calls of_node_put() for all
> device nodes it iterates over as long as we don't break or jump out of
> the loop.
> 
> Calling of_node_put() inside the ofpart_none path will wrongly decrement
> the ref count of the last node in the for_each_child_of_node() loop.
> 
> Move the call to of_node_put() under the ofpart_fail label to fix this.
> 

Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>

> Fixes: ebd5a74db74e ("mtd: ofpart: Check availability of reg property instead of name property")
> Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
> ---
>  drivers/mtd/parsers/ofpart_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mtd/parsers/ofpart_core.c b/drivers/mtd/parsers/ofpart_core.c
> index 0029bda165bd..181ae9616b2e 100644
> --- a/drivers/mtd/parsers/ofpart_core.c
> +++ b/drivers/mtd/parsers/ofpart_core.c
> @@ -195,11 +195,11 @@ static int parse_fixed_partitions(struct mtd_info *master,
>  ofpart_fail:
>  	pr_err("%s: error parsing ofpart partition %pOF (%pOF)\n",
>  	       master->name, pp, mtd_node);
> +	of_node_put(pp);
>  	ret = -EINVAL;
>  ofpart_none:
>  	if (dedicated)
>  		of_node_put(ofpart_node);
> -	of_node_put(pp);
>  	kfree(parts);
>  	return ret;
>  }
> -- 
> 2.53.0
> 

Kind Regards,
Tommaso

[PATCH 2/2] mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions

[Cosmin Tanislav]

In order to parse sub-partitions, add_mtd_partitions() calls
parse_mtd_partitions() for all previously found partitions.

Each partition will end up being passed to parse_fixed_partitions(), and
its of_node will be treated as the ofpart_node.

Commit 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in
parse_fixed_partitions()") added of_node_put() calls for ofpart_node on
all exit paths.

In the case where the partition passed to parse_fixed_partitions() has a
parent, it is treated as a dedicated partitions node, and of_node_put()
is wrongly called for it, even if of_node_get() was not called
explicitly.

On repeated bind / unbinds of the MTD, the extra of_node_put() ends up
decrementing the refcount down to 0, which should never happen,
resulting in the following error:

OF: ERROR: of_node_release() detected bad of_node_put() on
/soc/spi@80007000/flash@0/partitions/partition@0

Call of_node_get() to balance the call to of_node_put() done for
dedicated partitions nodes.

Fixes: 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()")
Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
---
 drivers/mtd/parsers/ofpart_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/parsers/ofpart_core.c b/drivers/mtd/parsers/ofpart_core.c
index 181ae9616b2e..262c4221d23f 100644
--- a/drivers/mtd/parsers/ofpart_core.c
+++ b/drivers/mtd/parsers/ofpart_core.c
@@ -75,7 +75,7 @@ static int parse_fixed_partitions(struct mtd_info *master,
 			dedicated = false;
 		}
 	} else { /* Partition */
-		ofpart_node = mtd_node;
+		ofpart_node = of_node_get(mtd_node);
 	}
 
 	of_id = of_match_node(parse_ofpart_match_table, ofpart_node);
-- 
2.53.0

Re: [PATCH 2/2] mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions

[Tommaso Merciai]

Hi Cosmin,
Thanks for your patch.

On Wed, Mar 11, 2026 at 05:39:57PM +0200, Cosmin Tanislav wrote:
> In order to parse sub-partitions, add_mtd_partitions() calls
> parse_mtd_partitions() for all previously found partitions.
> 
> Each partition will end up being passed to parse_fixed_partitions(), and
> its of_node will be treated as the ofpart_node.
> 
> Commit 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in
> parse_fixed_partitions()") added of_node_put() calls for ofpart_node on
> all exit paths.
> 
> In the case where the partition passed to parse_fixed_partitions() has a
> parent, it is treated as a dedicated partitions node, and of_node_put()
> is wrongly called for it, even if of_node_get() was not called
> explicitly.
> 
> On repeated bind / unbinds of the MTD, the extra of_node_put() ends up
> decrementing the refcount down to 0, which should never happen,
> resulting in the following error:
> 
> OF: ERROR: of_node_release() detected bad of_node_put() on
> /soc/spi@80007000/flash@0/partitions/partition@0
> 
> Call of_node_get() to balance the call to of_node_put() done for
> dedicated partitions nodes.
> 

Tested on RZ/G3E RZ SMARC Carrier II + PMOD SF3 connected to the
PMOD0_2A PIN HEADER.

rmmod spi_rzv2h_rspi
[   35.256402] Deleting MTD partitions on "spi0.0":
[   35.261078] Deleting scratch MTD partition
root@smarc-rzg3e:~# modprobe spi_rzv2h_rspi
[   38.058443] spi-nor spi0.0: supply vcc not found, using dummy regulator
[   38.083410] 1 fixed-partitions partitions found on MTD device spi0.0
[   38.089799] Creating 1 MTD partitions on "spi0.0":
[   38.094597] 0x000000000000-0x000002000000 : "scratch"
root@smarc-rzg3e:~# rmmod spi_rzv2h_rspi
[   40.996747] Deleting MTD partitions on "spi0.0":
[   41.001390] Deleting scratch MTD partition
root@smarc-rzg3e:~# modprobe spi_rzv2h_rspi
[   44.878004] spi-nor spi0.0: supply vcc not found, using dummy regulator
[   44.903571] 1 fixed-partitions partitions found on MTD device spi0.0
[   44.909980] Creating 1 MTD partitions on "spi0.0":
[   44.914777] 0x000000000000-0x000002000000 : "scratch"
root@smarc-rzg3e:~# rmmod spi_rzv2h_rspi
[   46.070797] Deleting MTD partitions on "spi0.0":
[   46.075469] Deleting scratch MTD partition
root@smarc-rzg3e:~# modprobe spi_rzv2h_rspi
[   47.093567] spi-nor spi0.0: supply vcc not found, using dummy regulator
[   47.117508] 1 fixed-partitions partitions found on MTD device spi0.0
[   47.123914] Creating 1 MTD partitions on "spi0.0":
[   47.128716] 0x000000000000-0x000002000000 : "scratch"
root@smarc-rzg3e:~# rmmod spi_rzv2h_rspi
[   48.032784] Deleting MTD partitions on "spi0.0":
[   48.037425] Deleting scratch MTD partition
root@smarc-rzg3e:~# rmmod spi_rzv2h_rspi[   48.520216] kauditd_printk_skb: 5 callbacks suppressed
[   48.520229] audit: type=1334 audit(946684832.940:22): prog-id=18 op=UNLOAD
[   48.532257] audit: type=1334 audit(946684832.940:23): prog-id=17 op=UNLOAD
[   48.539123] audit: type=1334 audit(946684832.940:24): prog-id=16 op=UNLOAD
modprobe spi_rzv2h_rspi
[   49.047496] spi-nor spi0.0: supply vcc not found, using dummy regulator
[   49.074166] 1 fixed-partitions partitions found on MTD device spi0.0
[   49.080554] Creating 1 MTD partitions on "spi0.0":
[   49.085348] 0x000000000000-0x000002000000 : "scratch"
root@smarc-rzg3e:~# rmmod spi_rzv2h_rspi
[   50.050056] Deleting MTD partitions on "spi0.0":
[   50.054703] Deleting scratch MTD partition


Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>

Thanks, Tommaso


> Fixes: 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()")
> Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
> ---
>  drivers/mtd/parsers/ofpart_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mtd/parsers/ofpart_core.c b/drivers/mtd/parsers/ofpart_core.c
> index 181ae9616b2e..262c4221d23f 100644
> --- a/drivers/mtd/parsers/ofpart_core.c
> +++ b/drivers/mtd/parsers/ofpart_core.c
> @@ -75,7 +75,7 @@ static int parse_fixed_partitions(struct mtd_info *master,
>  			dedicated = false;
>  		}
>  	} else { /* Partition */
> -		ofpart_node = mtd_node;
> +		ofpart_node = of_node_get(mtd_node);
>  	}
>  
>  	of_id = of_match_node(parse_ofpart_match_table, ofpart_node);
> -- 
> 2.53.0
> 

Re: [PATCH 0/2] MTD fixes for OF node refcounting

[Miquel Raynal]

On Wed, 11 Mar 2026 17:39:55 +0200, Cosmin Tanislav wrote:
> This series fixes an issue observed while repeatedly binding / unbinding
> the SPI controller driver to which a SPI NOR flash memory is attached,
> caused by commit 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node
> refcount leak in parse_fixed_partitions()"). See patch 2 for more
> details.
> 
> Patch 1 is the fix for another theorethical issue I have noticed while
> debugging the main issue.
> 
> [...]

Applied to mtd/next, thanks!

[1/2] mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
      commit: 0c87dea1aab86116211cb37387c404c9e9231c39
[2/2] mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
      commit: e882626c1747653f1f01ea9d12e278e613b11d0f

Patche(s) should be available on mtd/linux.git and will be
part of the next PR (provided that no robot complains by then).

Kind regards,
Miquèl