Re: [PATCH] net: ti: icssg-prueth: Fix device_node refcount leak in prueth_probe()

[Xiangwu Lai]

Hi,

Please find below the additional information netdev-bot requested
for this series.

How the issue was discovered: manual code inspection of the error
paths in prueth_probe() while auditing the driver for probe-time
resource leaks.

Whether the issue was actually triggered: no, it is purely
theoretical. The affected branches only run when the "ti,mii-g-rt"
or "ti,mii-rt" syscon regmap lookup fails, which happens only with a
malformed or incomplete device tree. On a valid DT these branches
are never taken. When they are, probe() fails with -ENODEV and the
of_node_get() references taken on eth0_node/eth1_node earlier in
the function are leaked silently; there is no stack trace or error
message pointing at the leak itself.

Hardware the change was tested on: none, it was not tested on real
hardware. The change only re-routes two error branches to the
existing put_cores label, which is already exercised by the other
failure paths in the same function (e.g. prueth_get_cores()
failures), so no new cleanup code is introduced.

Regarding the Sashiko findings:

- The leak in the SR1.0 sibling driver (icssg_prueth_sr1.c) is real,
  and it is fixed by a companion patch submitted at the same time as
  this one:

  https://lore.kernel.org/netdev/20261030085851.2019-1-laixiangwu@xxxxxxxxxxxxxxxxxxxx/

- The port-node loop issue is acknowledged as pre-existing and
  separate from what this patch fixes. References taken inside the
  port scan loop can also be lost on unusual DT input (a duplicate
  port reg value overwrites eth0_node/eth1_node and leaks the
  previous reference, and port nodes with a reg value other than 0
  or 1 keep a reference that is never stored or released). Fixing
  that requires a wider rework of the port parsing logic, so it is
  deliberately left out of this patch to keep the fix minimal. I
  can send a follow-up patch for it if reviewers consider it worth
  fixing.

Best regards,
Xiangwu Lai