Re: [PATCH v2] fix: net: renesas: rswitch_mii_register: fix double of_node_put after of_mdiobus_register

[WenTao Liang]

> 2026年6月27日 00:10，Andrew Lunn <andrew@xxxxxxx> 写道：
> 
> On Fri, Jun 26, 2026 at 11:25:50PM +0800, WenTao Liang wrote:
>> After of_mdiobus_register succeeds, the mdio_np reference ownership is
>>  transferred to the mii_bus device (released via fwnode_handle_put during
>>  mdiobus_release). The success path calls of_node_put(mdio_np) which,
>>  combined with the automatic release via bus teardown, results in a double
>>  put and refcount underflow.
>> 
>> Move of_node_put so it is only called in the error path where
>>  of_mdiobus_register failed. On success, the bus driver manages the
>>  reference lifecycle.
> 
> Please stop with these patches.
> 
> First please read:
> 
> https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html
> 
> and
> 
> https://docs.kernel.org/process/submitting-patches.html
> 
> You are getting a lot of things wrong. 
> 
> * don’t repost your patches within one 24h period
> * Don't thread new versions of a patch to the old one
> * Include version history, how is v2 different to v1
> * When you see your own patch is broken, reply with NACK, and explain
>  what is wrong with it.
> 
> Until you learn how to correctly submit patches, please only submit
> them one at a time, get it accepted, and move onto the next. Otherwise
> you are wasting peoples time, and getting yourself a bad reputation.
> 
>     Andrew


Hi Andrew,

Thank you for your careful review and for pointing out this issue. You are
absolutely correct — my previous analysis was flawed, and I appreciate you
taking the time to clarify.

Let me address your concerns:

1. On the double of_node_put():
   You are right. In the current error path, if mdiobus_register() succeeds
   and later macb_mii_probe() fails, the code jumps to err_out_unregister_bus,
   which calls mdiobus_unregister() and then mdiobus_free().
   - mdiobus_free() indeed releases the reference to the device node (via
     put_device()).
   - Adding an explicit of_node_put() in that same path would indeed result
     in a double decrement, which is incorrect and could lead to use-after-free
     or refcount underflow.

2. On the risk of untested patches:
   You are right to be cautious. I do not have access to the specific hardware
   to test this change, and I should have been more careful in reasoning about
   the reference counting semantics. I will refrain from submitting further
   patches in this area without proper testing or more thorough review of the
   existing code paths.

3. Proposed way forward:
   I will withdraw this patch for now. If I find a way to test it or gain more
   confidence through static analysis and documentation, I will resubmit with
   a clearer explanation and, ideally, test results.

Again, thank you for your diligence. I apologize for the noise and any extra
work this may have caused.

Please let me know if there is anything else I can clarify or help with.

Best regards,

WenTao Liang