Re: [PATCH] mtd: ubi: nvmem: Fix device_node leak in ubi_nvmem_add()

[Zhihao Cheng]

在 2026/10/27 17:15, Vishal Satle 写道:
> ubi_nvmem_add() calls of_get_child_by_name() to verify that the UBI
> volume device node contains an "nvmem-layout" subnode.
> of_get_child_by_name() returns a pointer to the child device_node
> with its reference count incremented.
>
> Because the returned pointer was only evaluated as a boolean condition
> and not retained or put, the reference count of the "nvmem-layout" node
> was leaked whenever an NVMEM-enabled UBI volume was registered.
>
> Assign the child node to a local variable and release it with
> of_node_put() once existence has been validated.
>
> Fixes: 34a5d8525b6a ("mtd: ubi: add NVMEM support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Vishal Satle <vishalsatleit24@xxxxxxxxx>
> ---
>   drivers/mtd/ubi/nvmem.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)

Reviewed-by: Zhihao Cheng <chengzhihao1@xxxxxxxxxx>
> diff --git a/drivers/mtd/ubi/nvmem.c b/drivers/mtd/ubi/nvmem.c
> index 2dade9727..15737d511 100644
> --- a/drivers/mtd/ubi/nvmem.c
> +++ b/drivers/mtd/ubi/nvmem.c
> @@ -61,6 +61,7 @@ static int ubi_nvmem_reg_read(void *priv, unsigned int from,
>   static int ubi_nvmem_add(struct ubi_volume_info *vi)
>   {
>   	struct device_node *np = dev_of_node(vi->dev);
> +	struct device_node *layout;
>   	struct nvmem_config config = {};
>   	struct ubi_nvmem *unv;
>   	int ret;
> @@ -68,9 +69,12 @@ static int ubi_nvmem_add(struct ubi_volume_info *vi)
>   	if (!np)
>   		return 0;
>   
> -	if (!of_get_child_by_name(np, "nvmem-layout"))
> +	layout = of_get_child_by_name(np, "nvmem-layout");
> +	if (!layout)
>   		return 0;
>   
> +	of_node_put(layout);
> +
>   	if (WARN_ON_ONCE(vi->usable_leb_size <= 0) ||
>   	    WARN_ON_ONCE(vi->size <= 0))
>   		return -EINVAL;