mtd: rawnand: Add Loongson-1 NAND Controller Driver

Hello Keguang Zhang,

Commit d2d10ede04b1 ("mtd: rawnand: Add Loongson-1 NAND Controller Driver") from Mar 20, 2025 (linux-next), leads to the following Smatch static checker warning:

	drivers/mtd/nand/raw/loongson1-nand-controller.c:730 ls1x_nand_chip_init()
	warn: inconsistent refcounting 'chip_np->kobj.kref.refcount.refs.counter':

drivers/mtd/nand/raw/loongson1-nand-controller.c

    690 static int ls1x_nand_chip_init(struct ls1x_nand_host *host)
    691 {
    692         struct device *dev = host->dev;
    693         int nchips = of_get_child_count(dev->of_node);
    694         struct device_node *chip_np;
    695         struct nand_chip *chip = &host->chip;
    696         struct mtd_info *mtd = nand_to_mtd(chip);
    697         int ret;
    698 
    699         if (nchips != 1)
    700                 return dev_err_probe(dev, -EINVAL, "Currently one NAND chip supported\n");
    701 
    702         chip_np = of_get_next_child(dev->of_node, NULL);

The of_get_next_child() function drops the reference on the current child. That's probably not what we want to happen. This is similar to a discussion we were having earlier about of_find_node_by_name().

Then it takes a reference to the new child.

    703         if (!chip_np)
    704                 return dev_err_probe(dev, -ENODEV, "failed to get child node for NAND chip\n");
    705 
    706         chip->controller = &host->controller;
    707         chip->options = NAND_NO_SUBPAGE_WRITE | NAND_USES_DMA | NAND_BROKEN_XD;
    708         chip->buf_align = 16;
    709         nand_set_controller_data(chip, host);
    710         nand_set_flash_node(chip, chip_np);
    711         if (!mtd->name)
    712                 return dev_err_probe(dev, -EINVAL, "Missing MTD label\n");

of_node_put(chip_np) before returning.

    713 
    714         mtd->dev.parent = dev;
    715         mtd->owner = THIS_MODULE;
    716 
    717         ret = nand_scan(chip, 1);
    718         if (ret) {
    719                 of_node_put(chip_np);
    720                 return dev_err_probe(dev, ret, "failed to scan NAND chip\n");
    721         }
    722 
    723         ret = mtd_device_register(mtd, NULL, 0);
    724         if (ret) {
    725                 nand_cleanup(chip);
    726                 of_node_put(chip_np);
    727                 return dev_err_probe(dev, ret, "failed to register MTD device\n");
    728         }
    729 

I think we want to call of_node_put(chip_np) before returning on the success path as well?

--> 730         return 0;
    731 }

Quoted 25 lines · Dan Carpenter

Hello Keguang Zhang,

Commit d2d10ede04b1 ("mtd: rawnand: Add Loongson-1 NAND Controller Driver") from Mar 20, 2025 (linux-next), leads to the following Smatch static checker warning:

      drivers/mtd/nand/raw/loongson1-nand-controller.c:730 ls1x_nand_chip_init()
      warn: inconsistent refcounting 'chip_np->kobj.kref.refcount.refs.counter':

drivers/mtd/nand/raw/loongson1-nand-controller.c

    690 static int ls1x_nand_chip_init(struct ls1x_nand_host *host)
    691 {
    692         struct device *dev = host->dev;
    693         int nchips = of_get_child_count(dev->of_node);
    694         struct device_node *chip_np;
    695         struct nand_chip *chip = &host->chip;
    696         struct mtd_info *mtd = nand_to_mtd(chip);
    697         int ret;
    698
    699         if (nchips != 1)
    700                 return dev_err_probe(dev, -EINVAL, "Currently one NAND chip supported\n");
    701
    702         chip_np = of_get_next_child(dev->of_node, NULL);

Quoted 3 lines

The of_get_next_child() function drops the reference on the current child. That's probably not what we want to happen. This is similar to a discussion we were having earlier about of_find_node_by_name().

The current child here is NULL, so I don't think there's an issue.

Quoted 1 line

Then it takes a reference to the new child.

*That* causes issues that you outlined below.

Quoted 9 lines

    703         if (!chip_np)
    704                 return dev_err_probe(dev, -ENODEV, "failed to get child node for NAND chip\n");
    705
    706         chip->controller = &host->controller;
    707         chip->options = NAND_NO_SUBPAGE_WRITE | NAND_USES_DMA | NAND_BROKEN_XD;
    708         chip->buf_align = 16;
    709         nand_set_controller_data(chip, host);
    710         nand_set_flash_node(chip, chip_np);

Quoted 23 lines

    711         if (!mtd->name)
    712                 return dev_err_probe(dev, -EINVAL, "Missing MTD label\n");

of_node_put(chip_np) before returning.

    713
    714         mtd->dev.parent = dev;
    715         mtd->owner = THIS_MODULE;
    716
    717         ret = nand_scan(chip, 1);
    718         if (ret) {
    719                 of_node_put(chip_np);
    720                 return dev_err_probe(dev, ret, "failed to scan NAND chip\n");
    721         }
    722
    723         ret = mtd_device_register(mtd, NULL, 0);
    724         if (ret) {
    725                 nand_cleanup(chip);
    726                 of_node_put(chip_np);
    727                 return dev_err_probe(dev, ret, "failed to register MTD device\n");
    728         }
    729

Quoted 2 lines

I think we want to call of_node_put(chip_np) before returning on the success path as well?

I would instead declare the chip_np variable as

        struct device_node *chip_np __free(of_node_put) = NULL;

and drop all the of_node_put(chip_np) calls.

Quoted 2 lines

--> 730         return 0;
    731 }

--
Regards,

Laurent Pinchart