After slave_data->phy_node is assigned (via of_node_get or
  of_parse_phandle), if subsequent calls like of_get_phy_mode or
  ti_cm_get_macid fail, the error path jumps to err_node_put which only
  releases the loop's port_np reference but not the phy_node reference.
  This causes a device_node reference leak.

Release slave_data->phy_node via of_node_put before jumping to
  err_node_put on error paths after phy_node has been acquired.

Cc: stable@vger.kernel.org
Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac")
Signed-off-by: WenTao Liang <redacted>
---
 drivers/net/ethernet/ti/cpsw_new.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c
index c5be359f3c66..9f90d5a9d39f 100644
--- a/drivers/net/ethernet/ti/cpsw_new.c
+++ b/drivers/net/ethernet/ti/cpsw_new.c

@@ -1337,6 +1337,7 @@ static int cpsw_probe_dt(struct cpsw_common *cpsw)
 		if (ret) {
 			dev_err(dev, "%pOF read phy-mode err %d\n",
 				port_np, ret);
+			of_node_put(slave_data->phy_node);
 			goto err_node_put;
 		}
 

@@ -1344,8 +1345,10 @@ static int cpsw_probe_dt(struct cpsw_common *cpsw)
 		if (ret) {
 			ret = ti_cm_get_macid(dev, port_id - 1,
 					      slave_data->mac_addr);
-			if (ret)
+			if (ret) {
+				of_node_put(slave_data->phy_node);
 				goto err_node_put;
+			}
 		}
 
 		if (of_property_read_u32(port_np, "ti,dual-emac-pvid",

-- 
2.39.5 (Apple Git-154)