[PATCH] fix: net: mdio: of_phy_register_fixed_link: fix phy_device reference leak via discarded pointer

[WenTao Liang]

fixed_phy_register returns a struct phy_device pointer with a held
  reference on success. However, the register_phy label discards the
  pointer via PTR_ERR_OR_ZERO, and the phy_device's fwnode is not set, so
  of_phy_deregister_fixed_link cannot find the device via
  bus_find_device_by_fwnode to clean it up. This permanently leaks the
  phy_device and its device_node reference.

Store the returned phy_device pointer and set dev->fwnode so the
  deregister path can properly locate and clean it up.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 24c30dbbcdda ("of/mdio: Add support function for Ethernet fixed-link property")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 drivers/net/mdio/of_mdio.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c
index b8d298c04d3f..0dd25d94fec0 100644
--- a/drivers/net/mdio/of_mdio.c
+++ b/drivers/net/mdio/of_mdio.c
@@ -456,8 +456,16 @@ int of_phy_register_fixed_link(struct device_node *np)
 
 	return -ENODEV;
 
-register_phy:
-	return PTR_ERR_OR_ZERO(fixed_phy_register(&status, np));
+register_phy: {
+	struct phy_device *phydev;
+
+	phydev = fixed_phy_register(&status, np);
+	if (IS_ERR(phydev))
+		return PTR_ERR(phydev);
+
+	phydev->mdio.dev.fwnode = of_fwnode_handle(np);
+	return 0;
+}
 }
 EXPORT_SYMBOL(of_phy_register_fixed_link);
 
-- 
2.39.5 (Apple Git-154)