If factory OTP setup fails after the user OTP NVMEM device has been
registered, mtd_otp_nvmem_add() unregisters the user device but leaves
mtd->otp_user_nvmem set. On an error, the caller unregisters it again.
For -EOPNOTSUPP, registration continues and normal teardown unregisters
it again.

Clear mtd->otp_user_nvmem after unregistering it.

Fixes: e0489f6e221f ("mtd: core: fix error path for nvmem provider")
Fixes: fe0b8213c012 ("mtd: core: Don't fail mtd_otp_nvmem_add() if OTP is unsupported")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 drivers/mtd/mtdcore.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 16629382a787b..6158452be24d6 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -1083,6 +1083,7 @@ static int mtd_otp_nvmem_add(struct mtd_info *mtd)
 
 err:
 	nvmem_unregister(mtd->otp_user_nvmem);
+	mtd->otp_user_nvmem = NULL;
 	/* Don't report error if OTP is not supported. */
 	if (err == -EOPNOTSUPP)
 		return 0;

base-commit: 3eb40771c00a8488fa6ed2cc1fe203477908bf38
-- 
2.53.0

On Sun, 16 Aug 2026 18:30:27 +0200, Karl Mehltretter wrote:
> If factory OTP setup fails after the user OTP NVMEM device has been
> registered, mtd_otp_nvmem_add() unregisters the user device but leaves
> mtd->otp_user_nvmem set. On an error, the caller unregisters it again.
> For -EOPNOTSUPP, registration continues and normal teardown unregisters
> it again.
> 
> Clear mtd->otp_user_nvmem after unregistering it.
> 
> [...]

Applied to mtd/fixes, thanks!

[1/1] mtd: core: avoid double-free of OTP NVMEM device
      commit: 26300879cd8e4612dce66bb8f6ff7cd35fcf3e59

Patche(s) should be available on mtd/linux.git and will be
part of the next PR (provided that no robot complains by then).

Kind regards,
Miquèl