[PATCH] net: bcmasp: fix MDIO child device leaks

[Guangshuo Li <lgs201920130244@gmail.com>]

bcmasp_probe() populates MDIO child platform devices using
of_platform_populate(). If initialization later fails, the probe error
paths clean up interfaces and clock state without depopulating those
child devices.

The normal remove path has the same issue and leaves the populated
MDIO devices registered after the ASP driver is unbound.

Add a separate error path for failures that occur after the MDIO
devices have been populated, and call of_platform_depopulate() there.
Also depopulate the child devices during normal driver removal.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/net/ethernet/broadcom/asp2/bcmasp.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp.c b/drivers/net/ethernet/broadcom/asp2/bcmasp.c
index 972474893a6b..c4087408a822 100644
--- a/drivers/net/ethernet/broadcom/asp2/bcmasp.c
+++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.c
@@ -1309,14 +1309,14 @@ static int bcmasp_probe(struct platform_device *pdev)
 					 sizeof(*priv->mda_filters), GFP_KERNEL);
 	if (!priv->mda_filters) {
 		ret = -ENOMEM;
-		goto err_clock_disable;
+		goto err_depopulate;
 	}
 
 	priv->net_filters = devm_kcalloc(dev, priv->num_net_filters,
 					 sizeof(*priv->net_filters), GFP_KERNEL);
 	if (!priv->net_filters) {
 		ret = -ENOMEM;
-		goto err_clock_disable;
+		goto err_depopulate;
 	}
 
 	bcmasp_core_init_filters(priv);
@@ -1327,7 +1327,7 @@ static int bcmasp_probe(struct platform_device *pdev)
 	if (!ports_node) {
 		dev_warn(dev, "No ports found\n");
 		ret = -EINVAL;
-		goto err_clock_disable;
+		goto err_depopulate;
 	}
 
 	i = 0;
@@ -1369,6 +1369,8 @@ static int bcmasp_probe(struct platform_device *pdev)
 
 err_cleanup:
 	bcmasp_remove_intfs(priv);
+err_depopulate:
+	of_platform_depopulate(dev);
 err_clock_disable:
 	clk_disable_unprepare(priv->clk);
 
@@ -1383,6 +1385,7 @@ static void bcmasp_remove(struct platform_device *pdev)
 		return;
 
 	bcmasp_remove_intfs(priv);
+	of_platform_depopulate(&pdev->dev);
 }
 
 static void bcmasp_shutdown(struct platform_device *pdev)
-- 
2.43.0