Thread (3 messages) 3 messages, 2 authors, 2026-02-09

Re: [PATCH 5.10] net: mdio: fix unbalanced fwnode reference count in mdio_device_release()

From: David Nyström <hidden>
Date: 2026-02-09 08:16:06
Also in: stable


On Tue, 3 Feb 2026, Greg Kroah-Hartman wrote:
On Fri, Jan 16, 2026 at 11:14:45AM +0100, David Nyström wrote:
quoted
[ Upstream commit cb37617687f2bfa5b675df7779f869147c9002bd ]

There is warning report about of_node refcount leak
while probing mdio device:

OF: ERROR: memory leak, expected refcount 1 instead of 2,
of_node_get()/of_node_put() unbalanced - destroy cset entry:
attach overlay node /spi/soc@0/mdio@710700c0/ethernet@4

In of_mdiobus_register_device(), we increase fwnode refcount
by fwnode_handle_get() before associating the of_node with
mdio device, but it has never been decreased in normal path.
Since that, in mdio_device_release(), it needs to call
fwnode_handle_put() in addition instead of calling kfree()
directly.

After above, just calling mdio_device_free() in the error handle
path of of_mdiobus_register_device() is enough to keep the
refcount balanced.

(cherry picked from commit cb37617687f2bfa5b675df7779f869147c9002bd)

Fixes: a9049e0c513c ("mdio: Add support for mdio drivers.")
Signed-off-by: Zeng Heng <redacted>
Reviewed-by: Yang Yingliang <redacted>
Reviewed-by: Russell King (Oracle) <redacted>
Link: https://lore.kernel.org/r/20221203073441.3885317-1-zengheng4@huawei.com (local)
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David Nyström <redacted>
---
This series backports 1 commit(s) to the 5.10 stable tree.
---
 drivers/net/mdio/of_mdio.c    | 3 ++-
 drivers/net/phy/mdio_device.c | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c
index b254127cea50..355c3ee21cd7 100644
--- a/drivers/net/mdio/of_mdio.c
+++ b/drivers/net/mdio/of_mdio.c
@@ -168,8 +168,9 @@ static int of_mdiobus_register_device(struct mii_bus *mdio,
 	/* All data is now stored in the mdiodev struct; register it. */
 	rc = mdio_device_register(mdiodev);
 	if (rc) {
+		device_set_node(&mdiodev->dev, NULL);
+		fwnode_handle_put(fwnode);
 		mdio_device_free(mdiodev);
-		of_node_put(child);
 		return rc;
 	}
diff --git a/drivers/net/phy/mdio_device.c b/drivers/net/phy/mdio_device.c
index 797c41f5590e..f72d18ee2792 100644
--- a/drivers/net/phy/mdio_device.c
+++ b/drivers/net/phy/mdio_device.c
@@ -21,6 +21,7 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/unistd.h>
+#include <linux/property.h>

 void mdio_device_free(struct mdio_device *mdiodev)
 {
@@ -30,6 +31,7 @@ EXPORT_SYMBOL(mdio_device_free);

 static void mdio_device_release(struct device *dev)
 {
+	fwnode_handle_put(dev->fwnode);
 	kfree(to_mdio_device(dev));
 }

---
base-commit: f964b940099f9982d723d4c77988d4b0dda9c165
change-id: 20260115-backport_cb37617687f2_20260115100804-bb6cefe39d44

Best regards,
--
David Nyström [off-list ref]
Breaks the build, how did you test this:
drivers/net/mdio/of_mdio.c: In function ‘of_mdiobus_register_device’:
drivers/net/mdio/of_mdio.c:172:35: error: ‘fwnode’ undeclared (first use in this function); did you mean ‘inode’?
 172 |                 fwnode_handle_put(fwnode);
     |                                   ^~~~~~
     |                                   inode
Oops,
This patch was work-in-progress and should not have been sent your way.
Wont happen again.

Br,
David
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help