[PATCH] soc: microchip: mpfs-sys-controller: put the flash device reference

[Wentao Liang]

of_get_mtd_device_by_node() returns an mtd_info with a reference taken
on the MTD device, which is stored in sys_controller->flash.  The
reference is never released, neither when the last sys_controller user
goes away nor on the probe error path that frees a freshly allocated
controller without initialising the kref.

Balance it with put_mtd_device() in both places.

Fixes: 742aa6c563d2 ("soc: microchip: mpfs: enable access to the system controller's flash")
Cc: stable at vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab at iscas.ac.cn>
---
 drivers/soc/microchip/mpfs-sys-controller.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/soc/microchip/mpfs-sys-controller.c b/drivers/soc/microchip/mpfs-sys-controller.c
index ef27e1083f0f..96675b7de184 100644
--- a/drivers/soc/microchip/mpfs-sys-controller.c
+++ b/drivers/soc/microchip/mpfs-sys-controller.c
@@ -99,6 +99,8 @@ static void mpfs_sys_controller_delete(struct kref *kref)
 		container_of(kref, struct mpfs_sys_controller, consumers);
 
 	mbox_free_channel(sys_controller->chan);
+	if (!IS_ERR_OR_NULL(sys_controller->flash))
+		put_mtd_device(sys_controller->flash);
 	kfree(sys_controller);
 }
 
@@ -177,6 +179,8 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
 	mpfs_sys_controller_put(sys_controller);
 	return ret;
 out_free:
+	if (!IS_ERR_OR_NULL(sys_controller->flash))
+		put_mtd_device(sys_controller->flash);
 	kfree(sys_controller);
 	return ret;
 }
-- 
2.34.1