In order to parse sub-partitions, add_mtd_partitions() calls
parse_mtd_partitions() for all previously found partitions.

Each partition will end up being passed to parse_fixed_partitions(), and
its of_node will be treated as the ofpart_node.

Commit 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in
parse_fixed_partitions()") added of_node_put() calls for ofpart_node on
all exit paths.

In the case where the partition passed to parse_fixed_partitions() has a
parent, it is treated as a dedicated partitions node, and of_node_put()
is wrongly called for it, even if of_node_get() was not called
explicitly.

On repeated bind / unbinds of the MTD, the extra of_node_put() ends up
decrementing the refcount down to 0, which should never happen,
resulting in the following error:

OF: ERROR: of_node_release() detected bad of_node_put() on
/soc/spi@80007000/flash@0/partitions/partition@0

Call of_node_get() to balance the call to of_node_put() done for
dedicated partitions nodes.

Fixes: 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()")
Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
---
 drivers/mtd/parsers/ofpart_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/parsers/ofpart_core.c b/drivers/mtd/parsers/ofpart_core.c
index 181ae9616b2e..262c4221d23f 100644
--- a/drivers/mtd/parsers/ofpart_core.c
+++ b/drivers/mtd/parsers/ofpart_core.c
@@ -75,7 +75,7 @@ static int parse_fixed_partitions(struct mtd_info *master,
 			dedicated = false;
 		}
 	} else { /* Partition */
-		ofpart_node = mtd_node;
+		ofpart_node = of_node_get(mtd_node);
 	}
 
 	of_id = of_match_node(parse_ofpart_match_table, ofpart_node);
-- 
2.53.0

Hi Cosmin,
Thanks for your patch.

On Wed, Mar 11, 2026 at 05:39:57PM +0200, Cosmin Tanislav wrote:
> In order to parse sub-partitions, add_mtd_partitions() calls
> parse_mtd_partitions() for all previously found partitions.
> 
> Each partition will end up being passed to parse_fixed_partitions(), and
> its of_node will be treated as the ofpart_node.
> 
> Commit 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in
> parse_fixed_partitions()") added of_node_put() calls for ofpart_node on
> all exit paths.
> 
> In the case where the partition passed to parse_fixed_partitions() has a
> parent, it is treated as a dedicated partitions node, and of_node_put()
> is wrongly called for it, even if of_node_get() was not called
> explicitly.
> 
> On repeated bind / unbinds of the MTD, the extra of_node_put() ends up
> decrementing the refcount down to 0, which should never happen,
> resulting in the following error:
> 
> OF: ERROR: of_node_release() detected bad of_node_put() on
> /soc/spi@80007000/flash@0/partitions/partition@0
> 
> Call of_node_get() to balance the call to of_node_put() done for
> dedicated partitions nodes.
> 

Tested on RZ/G3E RZ SMARC Carrier II + PMOD SF3 connected to the
PMOD0_2A PIN HEADER.

rmmod spi_rzv2h_rspi
[   35.256402] Deleting MTD partitions on "spi0.0":
[   35.261078] Deleting scratch MTD partition
root@smarc-rzg3e:~# modprobe spi_rzv2h_rspi
[   38.058443] spi-nor spi0.0: supply vcc not found, using dummy regulator
[   38.083410] 1 fixed-partitions partitions found on MTD device spi0.0
[   38.089799] Creating 1 MTD partitions on "spi0.0":
[   38.094597] 0x000000000000-0x000002000000 : "scratch"
root@smarc-rzg3e:~# rmmod spi_rzv2h_rspi
[   40.996747] Deleting MTD partitions on "spi0.0":
[   41.001390] Deleting scratch MTD partition
root@smarc-rzg3e:~# modprobe spi_rzv2h_rspi
[   44.878004] spi-nor spi0.0: supply vcc not found, using dummy regulator
[   44.903571] 1 fixed-partitions partitions found on MTD device spi0.0
[   44.909980] Creating 1 MTD partitions on "spi0.0":
[   44.914777] 0x000000000000-0x000002000000 : "scratch"
root@smarc-rzg3e:~# rmmod spi_rzv2h_rspi
[   46.070797] Deleting MTD partitions on "spi0.0":
[   46.075469] Deleting scratch MTD partition
root@smarc-rzg3e:~# modprobe spi_rzv2h_rspi
[   47.093567] spi-nor spi0.0: supply vcc not found, using dummy regulator
[   47.117508] 1 fixed-partitions partitions found on MTD device spi0.0
[   47.123914] Creating 1 MTD partitions on "spi0.0":
[   47.128716] 0x000000000000-0x000002000000 : "scratch"
root@smarc-rzg3e:~# rmmod spi_rzv2h_rspi
[   48.032784] Deleting MTD partitions on "spi0.0":
[   48.037425] Deleting scratch MTD partition
root@smarc-rzg3e:~# rmmod spi_rzv2h_rspi[   48.520216] kauditd_printk_skb: 5 callbacks suppressed
[   48.520229] audit: type=1334 audit(946684832.940:22): prog-id=18 op=UNLOAD
[   48.532257] audit: type=1334 audit(946684832.940:23): prog-id=17 op=UNLOAD
[   48.539123] audit: type=1334 audit(946684832.940:24): prog-id=16 op=UNLOAD
modprobe spi_rzv2h_rspi
[   49.047496] spi-nor spi0.0: supply vcc not found, using dummy regulator
[   49.074166] 1 fixed-partitions partitions found on MTD device spi0.0
[   49.080554] Creating 1 MTD partitions on "spi0.0":
[   49.085348] 0x000000000000-0x000002000000 : "scratch"
root@smarc-rzg3e:~# rmmod spi_rzv2h_rspi
[   50.050056] Deleting MTD partitions on "spi0.0":
[   50.054703] Deleting scratch MTD partition


Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>

Thanks, Tommaso


> Fixes: 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()")
> Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
> ---
>  drivers/mtd/parsers/ofpart_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mtd/parsers/ofpart_core.c b/drivers/mtd/parsers/ofpart_core.c
> index 181ae9616b2e..262c4221d23f 100644
> --- a/drivers/mtd/parsers/ofpart_core.c
> +++ b/drivers/mtd/parsers/ofpart_core.c
> @@ -75,7 +75,7 @@ static int parse_fixed_partitions(struct mtd_info *master,
>  			dedicated = false;
>  		}
>  	} else { /* Partition */
> -		ofpart_node = mtd_node;
> +		ofpart_node = of_node_get(mtd_node);
>  	}
>  
>  	of_id = of_match_node(parse_ofpart_match_table, ofpart_node);
> -- 
> 2.53.0
>