of_get_mtd_device_by_node() returns an MTD device reference that the
caller has to drop with put_mtd_device().  The probe error paths return
without releasing it, and the reference stored in sys_controller->flash
is never dropped when the controller is destroyed either.

Release the flash on the probe error paths and in
mpfs_sys_controller_delete(), so the reference is always put.

Fixes: 742aa6c563d2 ("soc: microchip: mpfs: enable access to the system controller's flash")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/soc/microchip/mpfs-sys-controller.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/microchip/mpfs-sys-controller.c b/drivers/soc/microchip/mpfs-sys-controller.c
index 92d1142a59e6..ad57b09e5807 100644
--- a/drivers/soc/microchip/mpfs-sys-controller.c
+++ b/drivers/soc/microchip/mpfs-sys-controller.c
@@ -98,6 +98,8 @@ static void mpfs_sys_controller_delete(struct kref *kref)
 	struct mpfs_sys_controller *sys_controller =
 		container_of(kref, struct mpfs_sys_controller, consumers);
 
+	if (sys_controller->flash)
+		put_mtd_device(sys_controller->flash);
 	mbox_free_channel(sys_controller->chan);
 	kfree(sys_controller);
 }
@@ -159,7 +161,8 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
 	of_data = (struct mpfs_syscon_config *) device_get_match_data(dev);
 	if (!of_data) {
 		dev_err(dev, "Error getting match data\n");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out_free;
 	}
 
 	for (i = 0; i < of_data->nb_subdevs; i++) {
@@ -174,6 +177,10 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
 	return 0;
 
 out_free:
+	if (!IS_ERR_OR_NULL(sys_controller->flash))
+		put_mtd_device(sys_controller->flash);
+	if (!IS_ERR_OR_NULL(sys_controller->chan))
+		mbox_free_channel(sys_controller->chan);
 	kfree(sys_controller);
 	return ret;
 }
-- 
2.34.1