From 104f277e8a469f71ac3c74a0e9ebb8bf64c3fa06 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 28 Sep 2026 13:07:29 -0700 Subject: mtd: rawnand: fsl_ifc: allocate shared ctrl with devm_kzalloc Allocate the shared fsl_ifc_nand_ctrl structure against the controller device, which outlives all NAND child devices, so it is freed automatically. This drops the manual kfree() and the broken chip counter that was decremented in remove() but never incremented anywhere, leaking the structure and leaving the freed pointer in ctrl->nand on re-probe. Assisted-by: LLM Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/fsl_ifc_nand.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) (limited to 'drivers') diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c index be6bbc1c184d..cc75b6a67e07 100644 --- a/drivers/mtd/nand/raw/fsl_ifc_nand.c +++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c @@ -49,7 +49,6 @@ struct fsl_ifc_nand_ctrl { unsigned int index; /* Pointer to next byte to 'read' */ unsigned int oob; /* Non zero if operating on OOB data */ unsigned int eccread; /* Non zero for a full-page ECC read */ - unsigned int counter; /* counter for the initializations */ unsigned int max_bitflips; /* Saved during READ0 cmd */ }; @@ -1023,15 +1022,13 @@ static int fsl_ifc_nand_probe(struct platform_device *dev) mutex_lock(&fsl_ifc_nand_mutex); if (!fsl_ifc_ctrl_dev->nand) { - ifc_nand_ctrl = kzalloc_obj(*ifc_nand_ctrl); + ifc_nand_ctrl = devm_kzalloc(fsl_ifc_ctrl_dev->dev, sizeof(*ifc_nand_ctrl), + GFP_KERNEL); if (!ifc_nand_ctrl) { mutex_unlock(&fsl_ifc_nand_mutex); return -ENOMEM; } - ifc_nand_ctrl->read_bytes = 0; - ifc_nand_ctrl->index = 0; - ifc_nand_ctrl->addr = NULL; fsl_ifc_ctrl_dev->nand = ifc_nand_ctrl; nand_controller_init(&ifc_nand_ctrl->controller); @@ -1105,14 +1102,6 @@ static void fsl_ifc_nand_remove(struct platform_device *dev) nand_cleanup(chip); fsl_ifc_chip_remove(priv); - - mutex_lock(&fsl_ifc_nand_mutex); - ifc_nand_ctrl->counter--; - if (!ifc_nand_ctrl->counter) { - fsl_ifc_ctrl_dev->nand = NULL; - kfree(ifc_nand_ctrl); - } - mutex_unlock(&fsl_ifc_nand_mutex); } static const struct of_device_id fsl_ifc_nand_match[] = { -- cgit v1.2.3