mtd: Clean refcounting with MTD_PARTITIONED_MASTER

The logic is way too convoluted, let's clean the kref_get/put section to
clarify what this block does when using CONFIG_MTD_PARTITIONED_MASTER:
- Iterate through all the parent mtd devices
- Grab a reference over them all but the master
- Only grab the master whith CONFIG_MTD_PARTITIONED_MASTER
Same logic must apply in the put path, otherwise it would be broken.

Cc: Tomas Winkler <tomas.winkler@intel.com>
Cc: Alexander Usyskin <alexander.usyskin@intel.com>
Cc: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Fixes: 19bfa9ebebb5 ("mtd: use refcount to prevent corruption")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Tested-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://lore.kernel.org/linux-mtd/20230731090903.770277-1-miquel.raynal@bootlin.com

diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 46f15f6..9bd661b 100644 (file)
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -1247,14 +1247,15 @@ int __get_mtd_device(struct mtd_info *mtd)
                return -ENODEV;
        }
 
-       kref_get(&mtd->refcnt);
-
-       while (mtd->parent) {
-               if (IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER) || mtd->parent != master)
-                       kref_get(&mtd->parent->refcnt);
+       while (mtd) {
+               if (mtd != master)
+                       kref_get(&mtd->refcnt);
                mtd = mtd->parent;
        }
 
+       if (IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER))
+               kref_get(&master->refcnt);
+
        return 0;
 }
 EXPORT_SYMBOL_GPL(__get_mtd_device);
@@ -1338,10 +1339,12 @@ void __put_mtd_device(struct mtd_info *mtd)
 {
        struct mtd_info *master = mtd_get_master(mtd);
 
-       while (mtd != master) {
+       while (mtd) {
+               /* kref_put() can relese mtd, so keep a reference mtd->parent */
                struct mtd_info *parent = mtd->parent;
 
-               kref_put(&mtd->refcnt, mtd_device_release);
+               if (mtd != master)
+                       kref_put(&mtd->refcnt, mtd_device_release);
                mtd = parent;
        }