Executive brief
The Linux kernel's PL353 NAND flash controller driver had a resource management bug where memory-mapped I/O registers were not properly released during driver unload. When the driver module is unloaded, the mapped register area remained allocated, causing a resource leak. This fix corrects the device reference in the resource cleanup function to ensure proper release of the register memory on driver removal.
Technical details
This is a resource management bug in the ARM PL353 SMC NAND controller driver (drivers/mtd/nand/raw/pl35x-nand-controller.c). During probe(), the devm_ioremap_resource() function was incorrectly called with the parent device (&smc_amba->dev) instead of the current NAND controller device, causing the I/O-remapped register area to be tracked for cleanup against the wrong device. When the driver module is unloaded, the cleanup code targets the parent device's resources, leaving the NAND controller's mapped registers unreleased. The fix changes the device parameter from &smc_amba->dev to nfc->dev. This is a minor resource leak with local impact only; exploitation requires the ability to load and unload the driver module.
Affected products
- Linux Linux kernel all versions after 08d8c62164a3 (PL353 NAND controller support introduction)
Timeline
- 2026-08-15: disclosed
- 2026-05-26: patched