ebu_nand_probe() gets a reference to the NAND chip node with of_get_next_child(). The probe failure paths release the reference with of_node_put(), but the successful probe path keeps it for the lifetime of the device and ebu_nand_remove() never drops it. As a result, each bind/unbind cycle leaks a reference to the NAND chip device node. Drop the reference in ebu_nand_remove() after the NAND teardown using the flash node stored in the NAND chip. This issue was found by manual code inspection. Fixes: bfc618fcc3f1 ("mtd: rawnand: intel: Read the chip-select line from the correct OF node") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/mtd/nand/raw/intel-nand-controller.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c index 01cefdaf115d..9f3e3a6cec71 100644 --- a/drivers/mtd/nand/raw/intel-nand-controller.c +++ b/drivers/mtd/nand/raw/intel-nand-controller.c @@ -711,6 +711,7 @@ static int ebu_nand_probe(struct platform_device *pdev) static void ebu_nand_remove(struct platform_device *pdev) { struct ebu_nand_controller *ebu_host = platform_get_drvdata(pdev); + struct device_node *chip_np = nand_get_flash_node(&ebu_host->chip); int ret; ret = mtd_device_unregister(nand_to_mtd(&ebu_host->chip)); @@ -718,6 +719,7 @@ static void ebu_nand_remove(struct platform_device *pdev) nand_cleanup(&ebu_host->chip); ebu_nand_disable(&ebu_host->chip); ebu_dma_cleanup(ebu_host); + of_node_put(chip_np); } static const struct of_device_id ebu_nand_match[] = { -- 2.43.0