Re: [PATCH v2] net: stmmac: release MDIO node if bus data allocation fails

[Maxime Chevallier]

Hi,

On 11/8/26 12:02, Wentao Liang wrote:
> stmmac_mdio_setup() takes a reference on the MDIO device tree node and
> stores it in plat->mdio_node before allocating plat->mdio_bus_data. If
> that allocation fails, the function returns -ENOMEM and the caller
> jumps to error_put_phy, which only drops plat->phy_node, so the
> reference on the MDIO node is leaked.
> 
> Release the reference before returning, using an error label so that
> the cleanup stays in one place.
> 
> The issue was found by a static analysis tool; the candidate was then
> audited and the fix was prepared with the help of DeepSeek and
> GPT-6.1 Sol. It was identified by code inspection only and was not
> triggered; this patch was compile-tested, not tested on hardware.
> 
> Fixes: 1a981c0586c0 ("net: stmmac: Make MDIO bus reset optional")
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>

Reviewed-by: Maxime Chevallier <maxime.chevallier@xxxxxxxxxxx>

Maxime

> ---
> Changes in v2:
> - Sorry for the very late follow-up to the review.
> - Use a goto-based error label, as suggested by Simon Horman,
>   instead of an inline of_node_put().
> - Describe how the issue was found and how it was tested, as
>   requested by netdev-bot.
> - Drop Cc: stable@xxxxxxxxxxxxxxx: the leak is only reachable when
>   the bus data allocation fails.
> 
>  drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> index 3ea16d618215..ded352afd103 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> @@ -356,12 +356,17 @@ static int stmmac_mdio_setup(struct plat_stmmacenet_data *plat,
>  						   sizeof(*plat->mdio_bus_data),
>  						   GFP_KERNEL);
>  		if (!plat->mdio_bus_data)
> -			return -ENOMEM;
> +			goto err_put_mdio_node;
>  
>  		plat->mdio_bus_data->needs_reset = true;
>  	}
>  
>  	return 0;
> +
> +err_put_mdio_node:
> +	of_node_put(plat->mdio_node);
> +	plat->mdio_node = NULL;
> +	return -ENOMEM;
>  }
>  
>  /**