Re: [PATCH net-next] net: netsec: fix device_node reference leak on phy_np

[Simon Horman]

On Sun, Sep 13, 2026 at 02:41:02PM +0800, Yige Jiang wrote:
> netsec_of_probe() takes a reference on the PHY device_node with
> of_parse_phandle() and stores it in priv->phy_np, but the driver never
> drops it.  One device_node reference is leaked per probe, on the success
> path as well as on every error path reached after netsec_of_probe().
> 
> Neither consumer takes ownership.  of_mdio_parse_addr() is a static
> inline taking a const struct device_node * that only reads the "reg"
> property.  of_phy_connect() borrows as well: of_phy_get_and_connect() in
> drivers/net/mdio/of_mdio.c brackets its own call with of_node_get() at
> :364 and of_node_put() at :373, which would be a double put if
> of_phy_connect() consumed the reference.
> 
> The node is still in use at netsec_netdev_open() time, where it is
> passed to of_phy_connect(), so it has device lifetime.  Release it at
> the probe error label, which every failure path after the acquire
> funnels through, and in netsec_remove().  Both releases precede
> free_netdev(), since priv is netdev_priv(ndev).  The ACPI probe path
> leaves priv->phy_np NULL and of_node_put(NULL) is a no-op.
> 
> There is no end-user visible symptom on currently supported platforms:
> a device_node is only freed once OF_DYNAMIC is enabled and the node has
> been detached, so on a static device tree the imbalance is inert.  It is
> observable as a refcount that grows across bind/unbind cycles, and would
> matter under device tree overlays.
> 
> Found by static analysis of reference acquire/release pairing rather
> than from a runtime report.  No reproducer was produced and the change
> has not been runtime tested; it is compile-tested only (arm64,
> CONFIG_SNI_NETSEC=m via COMPILE_TEST).
> 
> Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver")
> Assisted-by: LLM
> Signed-off-by: Yige Jiang <yigejiang86@xxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>