[PATCH] soc: microchip: mpfs: Fix flash leak in mpfs_sys_controller_probe()

[Conor Dooley]

On Fri, Oct 02, 2026 at 06:48:28PM +0100, Conor Dooley wrote:
> On Thu, Sep 17, 2026 at 03:35:50PM +0000, Wentao Liang wrote:
> > of_get_mtd_device_by_node() returns an MTD device reference that the
> > caller has to drop with put_mtd_device().  The probe error paths return
> > without releasing it, and the reference stored in sys_controller->flash
> > is never dropped when the controller is destroyed either.
> > 
> > Release the flash on the probe error paths and in
> > mpfs_sys_controller_delete(), so the reference is always put.
> 
> Is this diff sufficient?
> If probe passes, shouldn't the driver also call this during removal?
> 
> Removal here just decrements the refcount, so the delete function is
> where the call would have to go. Another patch for this driver pointed
> out that the teardown code should actually call mpfs_sys_controller_put()
> https://patchwork.kernel.org/project/lei-conor/patch/20260924110054.1553880-1-lgs201920130244@gmail.com/
> so the right thing to do here is probably a mix of what you've got here
> and what was done in that patch?
> 
> I note that the other user of this function, u-boot-env.c, doesn't call
> this either.

I've applied a v2 of that patch I mentioned, so I'll expect a new
iteration here on top of that:
https://patchwork.kernel.org/project/lei-conor/patch/20261007121743.192486-1-lgs201920130244@gmail.com/

Cheers,
Conor.

> 
> Cheers,
> Conor.
> 
> > 
> > Fixes: 742aa6c563d2 ("soc: microchip: mpfs: enable access to the system controller's flash")
> > Cc: stable at vger.kernel.org
> > Signed-off-by: Wentao Liang <vulab at iscas.ac.cn>
> > ---
> >  drivers/soc/microchip/mpfs-sys-controller.c | 9 ++++++++-
> >  1 file changed, 8 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/soc/microchip/mpfs-sys-controller.c b/drivers/soc/microchip/mpfs-sys-controller.c
> > index 92d1142a59e6..ad57b09e5807 100644
> > --- a/drivers/soc/microchip/mpfs-sys-controller.c
> > +++ b/drivers/soc/microchip/mpfs-sys-controller.c
> > @@ -98,6 +98,8 @@ static void mpfs_sys_controller_delete(struct kref *kref)
> >  	struct mpfs_sys_controller *sys_controller =
> >  		container_of(kref, struct mpfs_sys_controller, consumers);
> >  
> > +	if (sys_controller->flash)
> > +		put_mtd_device(sys_controller->flash);
> >  	mbox_free_channel(sys_controller->chan);
> >  	kfree(sys_controller);
> >  }
> > @@ -159,7 +161,8 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
> >  	of_data = (struct mpfs_syscon_config *) device_get_match_data(dev);
> >  	if (!of_data) {
> >  		dev_err(dev, "Error getting match data\n");
> > -		return -EINVAL;
> > +		ret = -EINVAL;
> > +		goto out_free;
> >  	}
> >  
> >  	for (i = 0; i < of_data->nb_subdevs; i++) {
> > @@ -174,6 +177,10 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
> >  	return 0;
> >  
> >  out_free:
> > +	if (!IS_ERR_OR_NULL(sys_controller->flash))
> > +		put_mtd_device(sys_controller->flash);
> > +	if (!IS_ERR_OR_NULL(sys_controller->chan))
> > +		mbox_free_channel(sys_controller->chan);
> >  	kfree(sys_controller);
> >  	return ret;
> >  }
> > -- 
> > 2.34.1
> > 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-riscv/attachments/20261008/959a2e7c/attachment.sig>