Re: [PATCH] net: ti: icssg-prueth-sr1: Fix device_node refcount leak in prueth_probe()

[netdev-bot+sashiko@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 0

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] The same leak is still present in the sister ICSSG driver.

--

net: ti: icssg-prueth-sr1: Fix device_node refcount leak in prueth_probe()

In the SR1.0 driver, prueth_probe() returned -ENODEV directly when the
"ti,mii-g-rt" or "ti,mii-rt" syscon regmap lookup failed. That return
leaked the eth0_node/eth1_node references taken with of_node_get(). The
patch sends both error paths to the existing put_cores label instead.

> diff --git a/drivers/net/ethernet/ti/icssg/icssg_prueth_sr1.c b/drivers/net/ethernet/ti/icssg/icssg_prueth_sr1.c
> index b8115ca47082f..ef1dc32ff8b46 100644
> --- a/drivers/net/ethernet/ti/icssg/icssg_prueth_sr1.c
> +++ b/drivers/net/ethernet/ti/icssg/icssg_prueth_sr1.c
> @@ -963,13 +963,15 @@ static int prueth_probe(struct platform_device *pdev)
>  	prueth->miig_rt = syscon_regmap_lookup_by_phandle(np, "ti,mii-g-rt");
>  	if (IS_ERR(prueth->miig_rt)) {
>  		dev_err(dev, "couldn't get ti,mii-g-rt syscon regmap\n");
> -		return -ENODEV;
> +		ret = -ENODEV;
> +		goto put_cores;
>  	}
>
>  	prueth->mii_rt = syscon_regmap_lookup_by_phandle(np, "ti,mii-rt");
>  	if (IS_ERR(prueth->mii_rt)) {
>  		dev_err(dev, "couldn't get ti,mii-rt syscon regmap\n");
> -		return -ENODEV;
> +		ret = -ENODEV;
> +		goto put_cores;
>  	}

[Severity: Medium]
The SR1 change looks correct. Does the sister driver still leak the
port@0/port@1 device_node references the same way?

prueth_probe() in drivers/net/ethernet/ti/icssg/icssg_prueth.c parses the
ports the same way. It calls of_node_get(eth_node) for each port and stores
the results in prueth->eth_node[]. It still returns directly on both syscon
lookup failures:

drivers/net/ethernet/ti/icssg/icssg_prueth.c:prueth_probe() {
    ...
	prueth->miig_rt = syscon_regmap_lookup_by_phandle(np, "ti,mii-g-rt");
	if (IS_ERR(prueth->miig_rt)) {
		dev_err(dev, "couldn't get ti,mii-g-rt syscon regmap\n");
		return -ENODEV;
	}

	prueth->mii_rt = syscon_regmap_lookup_by_phandle(np, "ti,mii-rt");
	if (IS_ERR(prueth->mii_rt)) {
		dev_err(dev, "couldn't get ti,mii-rt syscon regmap\n");
		return -ENODEV;
	}
    ...
put_cores:
	if (eth0_node || eth1_node) {
		prueth_put_cores(prueth, ICSS_SLICE0);
		of_node_put(eth0_node);
    ...
}

Both returns skip put_cores, which is the only place eth0_node and
eth1_node get released.

The same ret = -ENODEV; goto put_cores; change should work there without
modification:

  - prueth is allocated with devm_kzalloc().
  - prueth_put_cores() NULL-checks the core handles.
  - of_node_put(NULL) is a no-op.

Valid DTs can reach this path. The ti,icssg-prueth.yaml binding does not
list "ti,mii-rt" under required, so an AM64x/AM65x SR2.0 DT without that
phandle would leak these references on every probe attempt.

The SR2 driver would need a different Fixes: tag, so could this be sent as
a separate companion patch rather than folded into this one?

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261030085851.2019-1-laixiangwu%40cmss.chinamobile.com