Re: [PATCH] mmc: core: Fix OF node reference leak on card add failure

[Ulf Hansson]

On Fri, Sep 4, 2026 at 11:08 AM Zhu Ling <zhuling0805@xxxxxx> wrote:
>
> mmc_of_find_child_device() returns a device node with its reference count
> incremented. mmc_add_card() stores the reference before calling
> device_add(), while the card is marked present only after device_add()
> succeeds.
>
> If device_add() fails, the callers release the card through
> mmc_remove_card(). However, mmc_remove_card() only drops the OF node
> reference for a present card, leaking the reference on this error path.
>
> Move of_node_put() outside the present-card conditional so the reference
> is released for both registered cards and card-add failures.
>
> Fixes: 25185f3f31c9 ("mmc: Add SDIO function devicetree subnode parsing")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Zhu Ling <zhuling0805@xxxxxx>

Applied for fixes, thanks!

Kind regards
Uffe


> ---
>  drivers/mmc/core/bus.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
> index be5cf338bdeb..92ad39c0cabc 100644
> --- a/drivers/mmc/core/bus.c
> +++ b/drivers/mmc/core/bus.c
> @@ -417,8 +417,8 @@ void mmc_remove_card(struct mmc_card *card)
>                                 mmc_hostname(card->host), card->rca);
>                 }
>                 device_del(&card->dev);
> -               of_node_put(card->dev.of_node);
>         }
> +       of_node_put(card->dev.of_node);
>
>         if (host->cqe_enabled) {
>                 host->cqe_ops->cqe_disable(host);
>