Re: [PATCH] net: dsa: microchip: Fix parent_mdio_bus reference leak in ksz_mdio_register()

[Andrew Lunn]

On Thu, Sep 17, 2026 at 10:47:57AM +0000, Wentao Liang wrote:
> of_mdio_find_bus() returns a mii_bus whose embedded struct device has
> its reference count incremented. When ksz_mdio_register() fails after
> the parent bus has been stored in dev->parent_mdio_bus, that reference
> is never dropped, so the parent MDIO bus device leaks on every probe
> failure.
> 
> Drop the reference before returning from the error path.

What about the happy days path? Where is this reference dropped when
the driver is removed?

> 
> Fixes: 9afaf0eec2ab ("net: dsa: microchip: Refactor MDIO handling for side MDIO access")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>  drivers/net/dsa/microchip/ksz_common.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
> index 144373e13bea..fcf3a29ffca3 100644
> --- a/drivers/net/dsa/microchip/ksz_common.c
> +++ b/drivers/net/dsa/microchip/ksz_common.c
> @@ -2807,6 +2807,11 @@ static int ksz_mdio_register(struct ksz_device *dev)
>  	}
>  
>  put_mdio_node:
> +	if (ret && dev->parent_mdio_bus) {
> +		put_device(&dev->parent_mdio_bus->dev);
> +		dev->parent_mdio_bus = NULL;

Is setting dev->parent_mdio_bus to NULL required? If an error is
returned, does it ever get used?

    Andrew

---
pw-bot: cr