[PATCH] fsl/fman: Fix fm_node reference leak in read_dts_node()

[PATCH] fsl/fman: Fix fm_node reference leak in read_dts_node()

[Wentao Liang]

of_node_get() takes a reference on the FMan device node. That reference
is released neither on the success path, which returns straight after
of_platform_populate(), nor on the failure paths that jump to fman_free
without going through fman_node_put(). Neither read_dts_node() nor its
caller keeps fm_node around to release it later.

Release the reference on the success path, and route the remaining
failure paths through fman_node_put().

Fixes: ecb239d96d36 ("ethernet: fman: fix wrong of_node_put() in probe function")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/freescale/fman/fman.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
index 0f342b1a845b..403278aa357e 100644
--- a/drivers/net/ethernet/freescale/fman/fman.c
+++ b/drivers/net/ethernet/freescale/fman/fman.c
@@ -2758,7 +2758,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
 		err = -EINVAL;
 		dev_err(&of_dev->dev, "%s: could not find MURAM node\n",
 			__func__);
-		goto fman_free;
+		goto fman_node_put;
 	}
 
 	err = of_address_to_resource(muram_node, 0,
@@ -2767,7 +2767,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
 		of_node_put(muram_node);
 		dev_err(&of_dev->dev, "%s: of_address_to_resource() = %d\n",
 			__func__, err);
-		goto fman_free;
+		goto fman_node_put;
 	}
 
 	of_node_put(muram_node);
@@ -2777,7 +2777,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
 	if (err < 0) {
 		dev_err(&of_dev->dev, "%s: irq %d allocation failed (error = %d)\n",
 			__func__, irq, err);
-		goto fman_free;
+		goto fman_node_put;
 	}
 
 	if (fman->dts_params.err_irq != 0) {
@@ -2787,7 +2787,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
 		if (err < 0) {
 			dev_err(&of_dev->dev, "%s: irq %d allocation failed (error = %d)\n",
 				__func__, fman->dts_params.err_irq, err);
-			goto fman_free;
+			goto fman_node_put;
 		}
 	}
 
@@ -2795,7 +2795,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
 	if (IS_ERR(base_addr)) {
 		err = PTR_ERR(base_addr);
 		dev_err(&of_dev->dev, "%s: devm_ioremap() failed\n", __func__);
-		goto fman_free;
+		goto fman_node_put;
 	}
 
 	fman->dts_params.base_addr = base_addr;
@@ -2807,7 +2807,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
 	if (err) {
 		dev_err(&of_dev->dev, "%s: of_platform_populate() failed\n",
 			__func__);
-		goto fman_free;
+		goto fman_node_put;
 	}
 
 #ifdef CONFIG_DPAA_ERRATUM_A050385
@@ -2815,6 +2815,8 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
 		of_property_read_bool(fm_node, "fsl,erratum-a050385");
 #endif
 
+	of_node_put(fm_node);
+
 	return fman;
 
 fman_node_put:
-- 
2.34.1

Re: [PATCH] fsl/fman: Fix fm_node reference leak in read_dts_node()

[Simon Horman]

On Thu, Sep 17, 2026 at 11:03:42AM +0000, Wentao Liang wrote:
> of_node_get() takes a reference on the FMan device node. That reference
> is released neither on the success path, which returns straight after
> of_platform_populate(), nor on the failure paths that jump to fman_free
> without going through fman_node_put(). Neither read_dts_node() nor its
> caller keeps fm_node around to release it later.
> 
> Release the reference on the success path, and route the remaining
> failure paths through fman_node_put().
> 
> Fixes: ecb239d96d36 ("ethernet: fman: fix wrong of_node_put() in probe function")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Hi Wentao,

As flagged by W=1 builds, with this patch applied the fman_free tag is no
longer used. It should be removed.

Please be sure to check that your patches do not introduce any
new warnings when compiled with W=1.

Link: https://docs.kernel.org/process/maintainer-netdev.html#testing

-- 
pw-bot: changes-requested