[PATCH net 0/2] net: macb: fix two probe path leaks

[PATCH net 0/2] net: macb: fix two probe path leaks

[Nicolai Buchwitz]

Two independent leaks on macb probe paths, both noticed while reviewing
the fixed-link unbind crash fix [1].

Patch 1 destroys the phylink instance when probe fails after
macb_mii_init() has succeeded. Patch 2 drops the "mdio" child node
reference on the success path of macb_mii_init().

[1] https://lore.kernel.org/netdev/20260902102836.2019355-1-vineeth.karumanchi@amd.com/

Nicolai Buchwitz (2):
  net: macb: destroy the phylink instance on the probe error path
  net: macb: put the "mdio" child node reference on success

 drivers/net/ethernet/cadence/macb_main.c | 3 +++
 1 file changed, 3 insertions(+)


base-commit: 38b6be101006d3e7af972999f45d4f1e8250587a
-- 
2.53.0

[PATCH net 1/2] net: macb: destroy the phylink instance on the probe error path

[Nicolai Buchwitz]

macb_mii_init() creates a phylink instance on both of its success paths,
but the probe unwind frees the netdev without destroying it, so a failing
macb_alloc_tieoff() or register_netdev() leaks the instance.

Destroy it at err_out_unregister_mdio, which is only reachable once
macb_mii_init() has succeeded, so bp->phylink is valid there.

Fixes: 7897b071ac3b ("net: macb: convert to phylink")
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
---
 drivers/net/ethernet/cadence/macb_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 8469df0d89c3..bba7246e1dbd 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -5980,6 +5980,7 @@ static int macb_probe(struct platform_device *pdev)
 		mdiobus_unregister(bp->mii_bus);
 		mdiobus_free(bp->mii_bus);
 	}
+	phylink_destroy(bp->phylink);
 
 err_out_phy_exit:
 	phy_exit(bp->phy);
-- 
2.53.0

[PATCH net 2/2] net: macb: put the "mdio" child node reference on success

[Nicolai Buchwitz]

macb_mii_init() holds the reference returned by of_get_child_by_name()
for macb_mdiobus_register() and drops it only on the error paths, so
every successful probe leaks a node reference. On a CM5, overlay
removal after four bind cycles reports

  OF: ERROR: memory leak, expected refcount 1 instead of 5

Drop the reference after registration, where __mdiobus_register() has
already taken its own for the lifetime of the bus.

Fixes: 8a6631f1cece ("net: macb: avoid redundant lookup for "mdio" child node in MDIO setup")
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
---
 drivers/net/ethernet/cadence/macb_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index bba7246e1dbd..b1dc5840d756 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -1164,6 +1164,8 @@ static int macb_mii_init(struct macb *bp)
 	if (err)
 		goto err_out_unregister_bus;
 
+	of_node_put(mdio_np);
+
 	return 0;
 
 err_out_unregister_bus:
-- 
2.53.0

Re: [PATCH net 0/2] net: macb: fix two probe path leaks

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon,  7 Sep 2026 23:08:54 +0200 you wrote:
> Two independent leaks on macb probe paths, both noticed while reviewing
> the fixed-link unbind crash fix [1].
> 
> Patch 1 destroys the phylink instance when probe fails after
> macb_mii_init() has succeeded. Patch 2 drops the "mdio" child node
> reference on the success path of macb_mii_init().
> 
> [...]

Here is the summary with links:
  - [net,1/2] net: macb: destroy the phylink instance on the probe error path
    https://git.kernel.org/netdev/net/c/7d059f390750
  - [net,2/2] net: macb: put the "mdio" child node reference on success
    https://git.kernel.org/netdev/net/c/382a373d9ea7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html