netdev - [PATCH] net: dsa: microchip: fix mdio parent bus reference leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251121042000.20119-1-make24@iscas.ac.cn>
Date: Fri, 21 Nov 2025 12:20:00 +0800
From: Ma Ke <make24@...as.ac.cn>
To: woojung.huh@...rochip.com,
	UNGLinuxDriver@...rochip.com,
	andrew@...n.ch,
	olteanv@...il.com,
	davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com,
	o.rempel@...gutronix.de
Cc: netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	akpm@...ux-foundation.org,
	Ma Ke <make24@...as.ac.cn>,
	stable@...r.kernel.org
Subject: [PATCH] net: dsa: microchip: fix mdio parent bus reference leak

In ksz_mdio_register(), when of_mdio_find_bus() is called to get the
parent MDIO bus, it increments the reference count of the underlying
device. However, the reference are not released in error paths or
during switch teardown, causing a reference leak.

Add put_device() in the error path of ksz_mdio_register() and
ksz_teardown() to release the parent bus.

Found by code review.

Cc: stable@...r.kernel.org
Fixes: 9afaf0eec2ab ("net: dsa: microchip: Refactor MDIO handling for side MDIO access")
Signed-off-by: Ma Ke <make24@...as.ac.cn>
---
 drivers/net/dsa/microchip/ksz_common.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index 933ae8dc6337..49c0420a6df8 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -2795,6 +2795,11 @@ static int ksz_mdio_register(struct ksz_device *dev)
 	}
 
 put_mdio_node:
+	if (ret && dev->parent_mdio_bus) {
+		put_device(&dev->parent_mdio_bus->dev);
+		dev->parent_mdio_bus = NULL;
+	}
+
 	of_node_put(mdio_np);
 	of_node_put(parent_bus_node);
 
@@ -3110,6 +3115,11 @@ static void ksz_teardown(struct dsa_switch *ds)
 		ksz_irq_free(&dev->girq);
 	}
 
+	if (dev->parent_mdio_bus) {
+		put_device(&dev->parent_mdio_bus->dev);
+		dev->parent_mdio_bus = NULL;
+	}
+
 	if (dev->dev_ops->teardown)
 		dev->dev_ops->teardown(ds);
 }
-- 
2.17.1