[PATCH] mtd: rawnand: ndfc: fix I/O mapping leak on remove

[PATCH] mtd: rawnand: ndfc: fix I/O mapping leak on remove

[Guangshuo Li]

ndfc_probe() maps the controller registers with of_iomap(), but the
remove path does not call the matching iounmap() before the driver is
removed.

If ndfc_chip_init() fails, the probe error path correctly unmaps
ndfc->ndfcbase. However, after a successful probe, the mapping remains
active for the lifetime of the device and ndfc_remove() never releases
it, leaking the I/O mapping on driver unbind.

Call iounmap() in ndfc_remove() after the NAND device cleanup to release
the controller register mapping.

This issue was found by manual code inspection.

Fixes: a808ad3b0d28 ("[MTD] [NAND] ndfc driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/mtd/nand/raw/ndfc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mtd/nand/raw/ndfc.c b/drivers/mtd/nand/raw/ndfc.c
index a48274297d3b..0091b335b651 100644
--- a/drivers/mtd/nand/raw/ndfc.c
+++ b/drivers/mtd/nand/raw/ndfc.c
@@ -252,6 +252,7 @@ static void ndfc_remove(struct platform_device *ofdev)
 	WARN_ON(ret);
 	nand_cleanup(chip);
 	kfree(mtd->name);
+	iounmap(ndfc->ndfcbase);
 }
 
 static const struct of_device_id ndfc_match[] = {
-- 
2.43.0

Re: [PATCH] mtd: rawnand: ndfc: fix I/O mapping leak on remove

[Miquel Raynal]

On 16/09/2026 at 00:42:04 +08, Guangshuo Li <lgs201920130244@gmail.com> wrote:

> ndfc_probe() maps the controller registers with of_iomap(), but the
> remove path does not call the matching iounmap() before the driver is
> removed.
>
> If ndfc_chip_init() fails, the probe error path correctly unmaps
> ndfc->ndfcbase. However, after a successful probe, the mapping remains
> active for the lifetime of the device and ndfc_remove() never releases
> it, leaking the I/O mapping on driver unbind.
>
> Call iounmap() in ndfc_remove() after the NAND device cleanup to release
> the controller register mapping.
>
> This issue was found by manual code inspection.
>
> Fixes: a808ad3b0d28 ("[MTD] [NAND] ndfc driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

No longer applies after Rosen Penev's patch, can you please rebase on top?

Thanks,
Miquèl