[PATCH v2] net: stmmac: release MDIO node if bus data allocation fails

[PATCH v2] net: stmmac: release MDIO node if bus data allocation fails

[Wentao Liang]

stmmac_mdio_setup() takes a reference on the MDIO device tree node and
stores it in plat->mdio_node before allocating plat->mdio_bus_data. If
that allocation fails, the function returns -ENOMEM and the caller
jumps to error_put_phy, which only drops plat->phy_node, so the
reference on the MDIO node is leaked.

Release the reference before returning, using an error label so that
the cleanup stays in one place.

The issue was found by a static analysis tool; the candidate was then
audited and the fix was prepared with the help of DeepSeek and
GPT-6.1 Sol. It was identified by code inspection only and was not
triggered; this patch was compile-tested, not tested on hardware.

Fixes: 1a981c0586c0 ("net: stmmac: Make MDIO bus reset optional")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
- Sorry for the very late follow-up to the review.
- Use a goto-based error label, as suggested by Simon Horman,
  instead of an inline of_node_put().
- Describe how the issue was found and how it was tested, as
  requested by netdev-bot.
- Drop Cc: stable@vger.kernel.org: the leak is only reachable when
  the bus data allocation fails.

 drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 3ea16d618215..ded352afd103 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -356,12 +356,17 @@ static int stmmac_mdio_setup(struct plat_stmmacenet_data *plat,
 						   sizeof(*plat->mdio_bus_data),
 						   GFP_KERNEL);
 		if (!plat->mdio_bus_data)
-			return -ENOMEM;
+			goto err_put_mdio_node;
 
 		plat->mdio_bus_data->needs_reset = true;
 	}
 
 	return 0;
+
+err_put_mdio_node:
+	of_node_put(plat->mdio_node);
+	plat->mdio_node = NULL;
+	return -ENOMEM;
 }
 
 /**
-- 
2.34.1

Re: [PATCH v2] net: stmmac: release MDIO node if bus data allocation fails

[Maxime Chevallier]

Hi,

On 11/8/26 12:02, Wentao Liang wrote:
> stmmac_mdio_setup() takes a reference on the MDIO device tree node and
> stores it in plat->mdio_node before allocating plat->mdio_bus_data. If
> that allocation fails, the function returns -ENOMEM and the caller
> jumps to error_put_phy, which only drops plat->phy_node, so the
> reference on the MDIO node is leaked.
> 
> Release the reference before returning, using an error label so that
> the cleanup stays in one place.
> 
> The issue was found by a static analysis tool; the candidate was then
> audited and the fix was prepared with the help of DeepSeek and
> GPT-6.1 Sol. It was identified by code inspection only and was not
> triggered; this patch was compile-tested, not tested on hardware.
> 
> Fixes: 1a981c0586c0 ("net: stmmac: Make MDIO bus reset optional")
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>

Maxime

> ---
> Changes in v2:
> - Sorry for the very late follow-up to the review.
> - Use a goto-based error label, as suggested by Simon Horman,
>   instead of an inline of_node_put().
> - Describe how the issue was found and how it was tested, as
>   requested by netdev-bot.
> - Drop Cc: stable@vger.kernel.org: the leak is only reachable when
>   the bus data allocation fails.
> 
>  drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> index 3ea16d618215..ded352afd103 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> @@ -356,12 +356,17 @@ static int stmmac_mdio_setup(struct plat_stmmacenet_data *plat,
>  						   sizeof(*plat->mdio_bus_data),
>  						   GFP_KERNEL);
>  		if (!plat->mdio_bus_data)
> -			return -ENOMEM;
> +			goto err_put_mdio_node;
>  
>  		plat->mdio_bus_data->needs_reset = true;
>  	}
>  
>  	return 0;
> +
> +err_put_mdio_node:
> +	of_node_put(plat->mdio_node);
> +	plat->mdio_node = NULL;
> +	return -ENOMEM;
>  }
>  
>  /**