[PATCH] net: macb: Fix mdio_np reference leak in macb_mii_init()

[PATCH] net: macb: Fix mdio_np reference leak in macb_mii_init()

[Wentao Liang]

of_get_child_by_name() returns a device node with an elevated reference
count. macb_mii_init() drops it on the error paths via err_out, but the
success path returns 0 without calling of_node_put(), leaking a
reference to the "mdio" child node on every successful probe.

Release the reference before returning on the success path.

Fixes: 8a6631f1cece ("net: macb: avoid redundant lookup for "mdio" child node in MDIO setup")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/cadence/macb_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index a12aa21244e8..0c4775d51263 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -1164,6 +1164,8 @@ static int macb_mii_init(struct macb *bp)
 	if (err)
 		goto err_out_unregister_bus;
 
+	of_node_put(mdio_np);
+
 	return 0;
 
 err_out_unregister_bus:
-- 
2.34.1

Re: [PATCH] net: macb: Fix mdio_np reference leak in macb_mii_init()

[Théo Lebrun]

Hello Wentao,

On Thu Sep 17, 2026 at 12:52 PM CEST, Wentao Liang wrote:
> of_get_child_by_name() returns a device node with an elevated reference
> count. macb_mii_init() drops it on the error paths via err_out, but the
> success path returns 0 without calling of_node_put(), leaking a
> reference to the "mdio" child node on every successful probe.
>
> Release the reference before returning on the success path.
>
> Fixes: 8a6631f1cece ("net: macb: avoid redundant lookup for "mdio" child node in MDIO setup")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/ethernet/cadence/macb_main.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
> index a12aa21244e8..0c4775d51263 100644
> --- a/drivers/net/ethernet/cadence/macb_main.c
> +++ b/drivers/net/ethernet/cadence/macb_main.c
> @@ -1164,6 +1164,8 @@ static int macb_mii_init(struct macb *bp)
>  	if (err)
>  		goto err_out_unregister_bus;
>  
> +	of_node_put(mdio_np);
> +
>  	return 0;
>  
>  err_out_unregister_bus:

This patch has been sent by Nicolai last week. It has been applied &
merged into net/main then torvalds/master.

https://lore.kernel.org/netdev/20260907210856.1673589-3-nb@tipi-net.de/

⟩ git log --oneline --grep='child node reference on success' \
      torvalds/master drivers/net/ethernet/cadence/
382a373d9ea7a net: macb: put the "mdio" child node reference on success

Thanks,

--
Théo Lebrun, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com