[PATCH 42/58] mtd: rawnand: au1550nd: retain chip state across removal

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] mtd: rawnand: au1550nd: inverted request_mem_region check in
  au1550nd_probe() [1]
--

commit be3bdca7aa37bf9e70e43be29b0b99a9af4bfa13
Author: James Hilliard <james.hilliard1 at gmail.com>

mtd: rawnand: au1550nd: retain chip state across removal

This commit switches the au1550nd driver to reference-counted NAND
controller and chip lifetime management, disconnecting the chip before
unmapping MMIO and checking mtd_device_register() errors.

> diff --git a/drivers/mtd/nand/raw/au1550nd.c b/drivers/mtd/nand/raw/au1550nd.c
> index f1e99197ab845..bd78bcc842822 100644
> --- a/drivers/mtd/nand/raw/au1550nd.c
> +++ b/drivers/mtd/nand/raw/au1550nd.c

[ ... ]

> @@ -333,7 +350,6 @@ static int au1550nd_probe(struct platform_device *pdev)
>  out2:
>  	release_mem_region(r->start, resource_size(r));
>  out1:
> -	kfree(ctx);
>  	return ret;
>  }

[Severity: High]
This problem wasn't introduced by this patch, but isn't the
request_mem_region() check in au1550nd_probe() inverted [1]?

drivers/mtd/nand/raw/au1550nd.c:au1550nd_probe() {
    ...
	if (request_mem_region(r->start, resource_size(r), "au1550-nand")) {
		dev_err(&pdev->dev, "cannot claim NAND memory area\n");
		ret = -ENOMEM;
		goto out1;
	}
    ...
}

request_mem_region() returns a non-NULL pointer on success, so a
successful reservation jumps to out1, fails probe with -ENOMEM, and leaks
the claimed memory region. Conversely, a failed reservation proceeds to
ioremap() unowned memory.

[1] https://sashiko.dev/#/bug/linux-4e401697-4998-4e40-a7e4-60cc21983fb4

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107-submit-rawnand-retained-handle-lifetime-v1-v1-0-0181ef0cc4c8@gmail.com?part=42