[PATCH] mtd: virt_concat: Fix device_node reference leaks in mtd_virt_concat_create_item()

[Vishal Satle]

In mtd_virt_concat_create_item(), several device_node reference count leaks
and lifecycle bugs exist:

1. of_parse_phandle() returns a device_node with its refcount incremented.
   The validation loop calls mtd_is_part_concat() directly on the returned
   pointer without releasing it, leaking the node reference on every
   iteration and on early return.

2. item->nodes[0] is assigned directly from parts without acquiring a
   reference via of_node_get(). However, mtd_virt_concat_destroy_items()
   and mtd_virt_concat_destroy() call of_node_put() on all item->nodes,
   and mtd_virt_concat_node_create() drops its own reference on parts in
   the next iteration of of_find_node_with_property(), leading to an
   underflow / premature release of parts.

3. If kzalloc_flex() fails for concat, the error path frees item without
   releasing the acquired references in item->nodes[0..count-1].

Fix these issues by releasing next after mtd_is_part_concat() in the
validation loop, taking a reference with of_node_get() when assigning
item->nodes[0], and releasing all acquired node references if concat
allocation fails.

Signed-off-by: Vishal Satle <vishalsatleit24@xxxxxxxxx>
---
 drivers/mtd/mtd_virt_concat.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/mtd_virt_concat.c b/drivers/mtd/mtd_virt_concat.c
index 40b300021..6abc88251 100644
--- a/drivers/mtd/mtd_virt_concat.c
+++ b/drivers/mtd/mtd_virt_concat.c
@@ -163,7 +163,11 @@ static int mtd_virt_concat_create_item(struct device_node *parts,
 	int i;
 
 	for (i = 0; i < (count - 1); i++) {
-		if (mtd_is_part_concat(of_parse_phandle(parts, CONCAT_PROP, i)))
+		struct device_node *next = of_parse_phandle(parts, CONCAT_PROP, i);
+		bool is_concat = mtd_is_part_concat(next);
+
+		of_node_put(next);
+		if (is_concat)
 			return 0;
 	}
 
@@ -178,13 +182,15 @@ static int mtd_virt_concat_create_item(struct device_node *parts,
 	 * is defined is the first device in the list of concat
 	 * devices.
 	 */
-	item->nodes[0] = parts;
+	item->nodes[0] = of_node_get(parts);
 
 	for (i = 1; i < count; i++)
 		item->nodes[i] = of_parse_phandle(parts, CONCAT_PROP, (i - 1));
 
 	concat = kzalloc_flex(*concat, subdev, count);
 	if (!concat) {
+		for (i = 0; i < count; i++)
+			of_node_put(item->nodes[i]);
 		kfree(item);
 		return -ENOMEM;
 	}
-- 
2.53.0