From: Wentao Liang <vulab@iscas.ac.cn>
To: Maxime Chevallier <maxime.chevallier@bootlin.com>,
Alexandre Torgue <alexandre.torgue@foss.st.com>,
netdev@vger.kernel.org
Cc: Andrew Lunn <andrew+netdev@lunn.ch>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Maxime Coquelin <mcoquelin.stm32@gmail.com>,
Simon Horman <horms@kernel.org>,
linux-stm32@st-md-mailman.stormreply.com,
linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, vulab@iscas.ac.cn
Subject: [PATCH v2] net: stmmac: release MDIO node if bus data allocation fails
Date: Sun, 08 Nov 2026 11:02:31 +0000 [thread overview]
Message-ID: <20261108110231.315004-1-vulab@iscas.ac.cn> (raw)
stmmac_mdio_setup() takes a reference on the MDIO device tree node and
stores it in plat->mdio_node before allocating plat->mdio_bus_data. If
that allocation fails, the function returns -ENOMEM and the caller
jumps to error_put_phy, which only drops plat->phy_node, so the
reference on the MDIO node is leaked.
Release the reference before returning, using an error label so that
the cleanup stays in one place.
The issue was found by a static analysis tool; the candidate was then
audited and the fix was prepared with the help of DeepSeek and
GPT-6.1 Sol. It was identified by code inspection only and was not
triggered; this patch was compile-tested, not tested on hardware.
Fixes: 1a981c0586c0 ("net: stmmac: Make MDIO bus reset optional")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
- Sorry for the very late follow-up to the review.
- Use a goto-based error label, as suggested by Simon Horman,
instead of an inline of_node_put().
- Describe how the issue was found and how it was tested, as
requested by netdev-bot.
- Drop Cc: stable@vger.kernel.org: the leak is only reachable when
the bus data allocation fails.
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 3ea16d618215..ded352afd103 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -356,12 +356,17 @@ static int stmmac_mdio_setup(struct plat_stmmacenet_data *plat,
sizeof(*plat->mdio_bus_data),
GFP_KERNEL);
if (!plat->mdio_bus_data)
- return -ENOMEM;
+ goto err_put_mdio_node;
plat->mdio_bus_data->needs_reset = true;
}
return 0;
+
+err_put_mdio_node:
+ of_node_put(plat->mdio_node);
+ plat->mdio_node = NULL;
+ return -ENOMEM;
}
/**
--
2.34.1
next reply other threads:[~2026-11-08 11:00 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-08 11:02 Wentao Liang [this message]
2026-11-08 14:08 ` Maxime Chevallier
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261108110231.315004-1-vulab@iscas.ac.cn \
--to=vulab@iscas.ac.cn \
--cc=alexandre.torgue@foss.st.com \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-stm32@st-md-mailman.stormreply.com \
--cc=maxime.chevallier@bootlin.com \
--cc=mcoquelin.stm32@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®