[PATCH] nvmem: u-boot-env: release the MTD device reference

[Wentao Liang]

u_boot_env_probe() obtains the MTD device backing the environment with
of_get_mtd_device_by_node(), which takes a reference on the MTD device
and pins its owner module.  The reference is kept in priv->mtd for the
lifetime of the driver, but it is never dropped: there is no remove
callback and no devres action, so unbinding the driver or unloading the
module leaves the MTD device permanently referenced.  The reference is
also leaked when devm_nvmem_register() or u_boot_env_parse() fails
after the lookup.

Register a devres action that calls put_mtd_device() so the reference is
dropped when the device goes away, including the probe failure paths.

Fixes: d5542923f200 ("nvmem: add driver handling U-Boot environment variables")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/nvmem/u-boot-env.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/nvmem/u-boot-env.c b/drivers/nvmem/u-boot-env.c
index 467b288918db..5a62f3e0acc8 100644
--- a/drivers/nvmem/u-boot-env.c
+++ b/drivers/nvmem/u-boot-env.c
@@ -42,6 +42,11 @@ static int u_boot_env_read(void *context, unsigned int offset, void *val,
 	return 0;
 }
 
+static void u_boot_env_put_mtd(void *mtd)
+{
+	put_mtd_device(mtd);
+}
+
 static int u_boot_env_probe(struct platform_device *pdev)
 {
 	struct nvmem_config config = {
@@ -51,6 +56,7 @@ static int u_boot_env_probe(struct platform_device *pdev)
 	struct device *dev = &pdev->dev;
 	struct device_node *np = dev->of_node;
 	struct u_boot_env *priv;
+	int err;
 
 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
@@ -65,6 +71,10 @@ static int u_boot_env_probe(struct platform_device *pdev)
 		return PTR_ERR(priv->mtd);
 	}
 
+	err = devm_add_action_or_reset(dev, u_boot_env_put_mtd, priv->mtd);
+	if (err)
+		return err;
+
 	config.dev = dev;
 	config.priv = priv;
 	config.size = priv->mtd->size;
-- 
2.34.1