[PATCH] mmc: core: Fix OF node leak in mmc_add_card()

[PATCH] mmc: core: Fix OF node leak in mmc_add_card()

[Wentao Liang]

mmc_add_card() stores the OF node returned by
mmc_of_find_child_device() in card->dev.of_node before calling
device_add().  That node carries a reference which is normally
released in mmc_remove_card(), but only when the card has been
marked present.  If device_add() fails, mmc_card_set_present() is
never reached and the cleanup of the failed attach cannot release
the node, so the reference is leaked.

Release the reference on the device_add() failure path.

Fixes: 25185f3f31c9 ("mmc: Add SDIO function devicetree subnode parsing")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/mmc/core/bus.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
index be5cf338bdeb..4d862d9bab23 100644
--- a/drivers/mmc/core/bus.c
+++ b/drivers/mmc/core/bus.c
@@ -379,8 +379,11 @@ int mmc_add_card(struct mmc_card *card)
 	device_enable_async_suspend(&card->dev);
 
 	ret = device_add(&card->dev);
-	if (ret)
+	if (ret) {
+		of_node_put(card->dev.of_node);
+		card->dev.of_node = NULL;
 		return ret;
+	}
 
 	mmc_card_set_present(card);
 
-- 
2.34.1

Re: [PATCH] mmc: core: Fix OF node leak in mmc_add_card()

[Ulf Hansson]

On Thu, Sep 17, 2026 at 12:18 PM Wentao Liang <vulab@iscas.ac.cn> wrote:
>
> mmc_add_card() stores the OF node returned by
> mmc_of_find_child_device() in card->dev.of_node before calling
> device_add().  That node carries a reference which is normally
> released in mmc_remove_card(), but only when the card has been
> marked present.  If device_add() fails, mmc_card_set_present() is
> never reached and the cleanup of the failed attach cannot release
> the node, so the reference is leaked.
>
> Release the reference on the device_add() failure path.
>
> Fixes: 25185f3f31c9 ("mmc: Add SDIO function devicetree subnode parsing")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

We have already a commit that takes care of this ("08b54e16d547 mmc:
core: Fix OF node reference leak on card add failure")

Kind regards
Uffe

> ---
>  drivers/mmc/core/bus.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
> index be5cf338bdeb..4d862d9bab23 100644
> --- a/drivers/mmc/core/bus.c
> +++ b/drivers/mmc/core/bus.c
> @@ -379,8 +379,11 @@ int mmc_add_card(struct mmc_card *card)
>         device_enable_async_suspend(&card->dev);
>
>         ret = device_add(&card->dev);
> -       if (ret)
> +       if (ret) {
> +               of_node_put(card->dev.of_node);
> +               card->dev.of_node = NULL;
>                 return ret;
> +       }
>
>         mmc_card_set_present(card);
>
> --
> 2.34.1
>