mmc: core: Fix OF node reference leak on card add failure

[PATCH] mmc: core: Fix OF node reference leak on card add failure

Posted by Zhu Ling 3 weeks, 1 day ago

mmc_of_find_child_device() returns a device node with its reference count
incremented. mmc_add_card() stores the reference before calling
device_add(), while the card is marked present only after device_add()
succeeds.

If device_add() fails, the callers release the card through
mmc_remove_card(). However, mmc_remove_card() only drops the OF node
reference for a present card, leaking the reference on this error path.

Move of_node_put() outside the present-card conditional so the reference
is released for both registered cards and card-add failures.

Fixes: 25185f3f31c9 ("mmc: Add SDIO function devicetree subnode parsing")
Cc: stable@vger.kernel.org
Signed-off-by: Zhu Ling <zhuling0805@qq.com>
---
 drivers/mmc/core/bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
index be5cf338bdeb..92ad39c0cabc 100644
--- a/drivers/mmc/core/bus.c
+++ b/drivers/mmc/core/bus.c
@@ -417,8 +417,8 @@ void mmc_remove_card(struct mmc_card *card)
 				mmc_hostname(card->host), card->rca);
 		}
 		device_del(&card->dev);
-		of_node_put(card->dev.of_node);
 	}
+	of_node_put(card->dev.of_node);
 
 	if (host->cqe_enabled) {
 		host->cqe_ops->cqe_disable(host);

Re: [PATCH] mmc: core: Fix OF node reference leak on card add failure

Posted by Ulf Hansson 2 weeks, 2 days ago

On Fri, Sep 4, 2026 at 11:08 AM Zhu Ling <zhuling0805@qq.com> wrote:
>
> mmc_of_find_child_device() returns a device node with its reference count
> incremented. mmc_add_card() stores the reference before calling
> device_add(), while the card is marked present only after device_add()
> succeeds.
>
> If device_add() fails, the callers release the card through
> mmc_remove_card(). However, mmc_remove_card() only drops the OF node
> reference for a present card, leaking the reference on this error path.
>
> Move of_node_put() outside the present-card conditional so the reference
> is released for both registered cards and card-add failures.
>
> Fixes: 25185f3f31c9 ("mmc: Add SDIO function devicetree subnode parsing")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhu Ling <zhuling0805@qq.com>

Applied for fixes, thanks!

Kind regards
Uffe


> ---
>  drivers/mmc/core/bus.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
> index be5cf338bdeb..92ad39c0cabc 100644
> --- a/drivers/mmc/core/bus.c
> +++ b/drivers/mmc/core/bus.c
> @@ -417,8 +417,8 @@ void mmc_remove_card(struct mmc_card *card)
>                                 mmc_hostname(card->host), card->rca);
>                 }
>                 device_del(&card->dev);
> -               of_node_put(card->dev.of_node);
>         }
> +       of_node_put(card->dev.of_node);
>
>         if (host->cqe_enabled) {
>                 host->cqe_ops->cqe_disable(host);
>

Re: [PATCH] mmc: core: Fix OF node reference leak on card add failure

Posted by Shawn Lin 3 weeks, 1 day ago

On 2026/09/04 星期五 17:07, Zhu Ling wrote:
> mmc_of_find_child_device() returns a device node with its reference count
> incremented. mmc_add_card() stores the reference before calling
> device_add(), while the card is marked present only after device_add()
> succeeds.
> 
> If device_add() fails, the callers release the card through
> mmc_remove_card(). However, mmc_remove_card() only drops the OF node
> reference for a present card, leaking the reference on this error path.
> 
> Move of_node_put() outside the present-card conditional so the reference
> is released for both registered cards and card-add failures.
> 
> Fixes: 25185f3f31c9 ("mmc: Add SDIO function devicetree subnode parsing")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhu Ling <zhuling0805@qq.com>
> ---

Reviewed-by: Shawn Lin <shawn.lin@linux.dev>

>   drivers/mmc/core/bus.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
> index be5cf338bdeb..92ad39c0cabc 100644
> --- a/drivers/mmc/core/bus.c
> +++ b/drivers/mmc/core/bus.c
> @@ -417,8 +417,8 @@ void mmc_remove_card(struct mmc_card *card)
>   				mmc_hostname(card->host), card->rca);
>   		}
>   		device_del(&card->dev);
> -		of_node_put(card->dev.of_node);
>   	}
> +	of_node_put(card->dev.of_node);
>   
>   	if (host->cqe_enabled) {
>   		host->cqe_ops->cqe_disable(host);
> 
>