RE: [PATCH net-next] net: netsec: fix device_node reference leak on phy_np

[kojima.masahisa]

> netsec_of_probe() takes a reference on the PHY device_node with
> of_parse_phandle() and stores it in priv->phy_np, but the driver never
> drops it.  One device_node reference is leaked per probe, on the success
> path as well as on every error path reached after netsec_of_probe().
> 
> Neither consumer takes ownership.  of_mdio_parse_addr() is a static
> inline taking a const struct device_node * that only reads the "reg"
> property.  of_phy_connect() borrows as well: of_phy_get_and_connect() in
> drivers/net/mdio/of_mdio.c brackets its own call with of_node_get() at
> :364 and of_node_put() at :373, which would be a double put if
> of_phy_connect() consumed the reference.
> 
> The node is still in use at netsec_netdev_open() time, where it is
> passed to of_phy_connect(), so it has device lifetime.  Release it at
> the probe error label, which every failure path after the acquire
> funnels through, and in netsec_remove().  Both releases precede
> free_netdev(), since priv is netdev_priv(ndev).  The ACPI probe path
> leaves priv->phy_np NULL and of_node_put(NULL) is a no-op.
> 
> There is no end-user visible symptom on currently supported platforms:
> a device_node is only freed once OF_DYNAMIC is enabled and the node has
> been detached, so on a static device tree the imbalance is inert.  It is
> observable as a refcount that grows across bind/unbind cycles, and would
> matter under device tree overlays.
> 
> Found by static analysis of reference acquire/release pairing rather
> than from a runtime report.  No reproducer was produced and the change
> has not been runtime tested; it is compile-tested only (arm64,
> CONFIG_SNI_NETSEC=m via COMPILE_TEST).

Tested on SynQuacer.
Verified repeated load/unload cycles and network connectivity.

Tested-by: Masahisa Kojima <kojima.masahisa@xxxxxxxxxxxxx>

> 
> Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver")
> Assisted-by: LLM
> Signed-off-by: Yige Jiang <yigejiang86@xxxxxxxxx>
> ---
>  drivers/net/ethernet/socionext/netsec.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/socionext/netsec.c
> b/drivers/net/ethernet/socionext/netsec.c
> index d14a6584473c8..79a0a324c921d 100644
> --- a/drivers/net/ethernet/socionext/netsec.c
> +++ b/drivers/net/ethernet/socionext/netsec.c
> @@ -2149,6 +2149,7 @@ static int netsec_probe(struct platform_device
> *pdev)
>  	pm_runtime_put_sync(&pdev->dev);
>  	pm_runtime_disable(&pdev->dev);
>  free_ndev:
> +	of_node_put(priv->phy_np);
>  	free_netdev(ndev);
>  	dev_err(&pdev->dev, "init failed\n");
> 
> @@ -2166,6 +2167,7 @@ static void netsec_remove(struct platform_device
> *pdev)
>  	netif_napi_del(&priv->napi);
> 
>  	pm_runtime_disable(&pdev->dev);
> +	of_node_put(priv->phy_np);
>  	free_netdev(priv->ndev);
>  }
> 
> --
> 2.50.1 (Apple Git-155)