ofpart_none can only be reached after the for_each_child_of_node() loop
finishes. for_each_child_of_node() correctly calls of_node_put() for all
device nodes it iterates over as long as we don't break or jump out of
the loop.

Calling of_node_put() inside the ofpart_none path will wrongly decrement
the ref count of the last node in the for_each_child_of_node() loop.

Move the call to of_node_put() under the ofpart_fail label to fix this.

Fixes: ebd5a74db74e ("mtd: ofpart: Check availability of reg property instead of name property")
Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
---
 drivers/mtd/parsers/ofpart_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/parsers/ofpart_core.c b/drivers/mtd/parsers/ofpart_core.c
index 0029bda165bd..181ae9616b2e 100644
--- a/drivers/mtd/parsers/ofpart_core.c
+++ b/drivers/mtd/parsers/ofpart_core.c
@@ -195,11 +195,11 @@ static int parse_fixed_partitions(struct mtd_info *master,
 ofpart_fail:
 	pr_err("%s: error parsing ofpart partition %pOF (%pOF)\n",
 	       master->name, pp, mtd_node);
+	of_node_put(pp);
 	ret = -EINVAL;
 ofpart_none:
 	if (dedicated)
 		of_node_put(ofpart_node);
-	of_node_put(pp);
 	kfree(parts);
 	return ret;
 }
-- 
2.53.0

On Wed, Mar 11, 2026 at 05:39:56PM +0200, Cosmin Tanislav wrote:
> ofpart_none can only be reached after the for_each_child_of_node() loop
> finishes. for_each_child_of_node() correctly calls of_node_put() for all
> device nodes it iterates over as long as we don't break or jump out of
> the loop.
> 
> Calling of_node_put() inside the ofpart_none path will wrongly decrement
> the ref count of the last node in the for_each_child_of_node() loop.
> 
> Move the call to of_node_put() under the ofpart_fail label to fix this.
> 

Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>

> Fixes: ebd5a74db74e ("mtd: ofpart: Check availability of reg property instead of name property")
> Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
> ---
>  drivers/mtd/parsers/ofpart_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mtd/parsers/ofpart_core.c b/drivers/mtd/parsers/ofpart_core.c
> index 0029bda165bd..181ae9616b2e 100644
> --- a/drivers/mtd/parsers/ofpart_core.c
> +++ b/drivers/mtd/parsers/ofpart_core.c
> @@ -195,11 +195,11 @@ static int parse_fixed_partitions(struct mtd_info *master,
>  ofpart_fail:
>  	pr_err("%s: error parsing ofpart partition %pOF (%pOF)\n",
>  	       master->name, pp, mtd_node);
> +	of_node_put(pp);
>  	ret = -EINVAL;
>  ofpart_none:
>  	if (dedicated)
>  		of_node_put(ofpart_node);
> -	of_node_put(pp);
>  	kfree(parts);
>  	return ret;
>  }
> -- 
> 2.53.0
> 

Kind Regards,
Tommaso