[PATCH] net: stmmac: Fix MDIO node leak in stmmac_mdio_setup()

[PATCH] net: stmmac: Fix MDIO node leak in stmmac_mdio_setup()

[Wentao Liang]

stmmac_mdio_setup() acquires a reference on the MDIO node through
stmmac_of_get_mdio() and stores it in plat->mdio_node. If the allocation
of plat->mdio_bus_data fails, the function returns -ENOMEM and the
caller takes the error_put_phy path, which only releases plat->phy_node,
so the MDIO node reference is leaked.

Release plat->mdio_node on this error path.

Fixes: 1a981c0586c0 ("net: stmmac: Make MDIO bus reset optional")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 5cae2aa72906..09359ccb32ef 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -356,8 +356,11 @@ static int stmmac_mdio_setup(struct plat_stmmacenet_data *plat,
 		plat->mdio_bus_data = devm_kzalloc(dev,
 						   sizeof(*plat->mdio_bus_data),
 						   GFP_KERNEL);
-		if (!plat->mdio_bus_data)
+		if (!plat->mdio_bus_data) {
+			of_node_put(plat->mdio_node);
+			plat->mdio_node = NULL;
 			return -ENOMEM;
+		}
 
 		plat->mdio_bus_data->needs_reset = true;
 	}
-- 
2.34.1

Re: [PATCH] net: stmmac: Fix MDIO node leak in stmmac_mdio_setup()

[Simon Horman]

On Thu, Sep 17, 2026 at 11:39:45AM +0000, Wentao Liang wrote:
> stmmac_mdio_setup() acquires a reference on the MDIO node through
> stmmac_of_get_mdio() and stores it in plat->mdio_node. If the allocation
> of plat->mdio_bus_data fails, the function returns -ENOMEM and the
> caller takes the error_put_phy path, which only releases plat->phy_node,
> so the MDIO node reference is leaked.
> 
> Release plat->mdio_node on this error path.
> 
> Fixes: 1a981c0586c0 ("net: stmmac: Make MDIO bus reset optional")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> index 5cae2aa72906..09359ccb32ef 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> @@ -356,8 +356,11 @@ static int stmmac_mdio_setup(struct plat_stmmacenet_data *plat,
>  		plat->mdio_bus_data = devm_kzalloc(dev,
>  						   sizeof(*plat->mdio_bus_data),
>  						   GFP_KERNEL);
> -		if (!plat->mdio_bus_data)
> +		if (!plat->mdio_bus_data) {
> +			of_node_put(plat->mdio_node);
> +			plat->mdio_node = NULL;
>  			return -ENOMEM;
> +		}
>  
>  		plat->mdio_bus_data->needs_reset = true;
>  	}

Hi Wentao,

As per my comment on another one of your recent patches, I think this
change would be somewhat more robust against future changes to this
function if it was implemented using a goto-driven unwind ladder, which is
the generally preferred in Networking code.

Something like this (compile tested only!):

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 3ea16d618215..ded352afd103 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -356,12 +356,17 @@ static int stmmac_mdio_setup(struct plat_stmmacenet_data *plat,
 						   sizeof(*plat->mdio_bus_data),
 						   GFP_KERNEL);
 		if (!plat->mdio_bus_data)
-			return -ENOMEM;
+			goto err_put_mdio_node;

 		plat->mdio_bus_data->needs_reset = true;
 	}

 	return 0;
+
+err_put_mdio_node:
+	of_node_put(plat->mdio_node);
+	plat->mdio_node = NULL;
+	return -ENOMEM;
 }

 /**

-- 
pw-bot: changes-requested