Thread (5 messages) flat view 5 messages, 2 authors, 2026-06-28
STALE76d

[PATCH] fix: net: renesas: rswitch_mii_register: fix double of_node_put after of_mdiobus_register

From: WenTao Liang <hidden>
Date: 2026-06-26 15:24:36
Also in: lkml, stable
Subsystem: networking drivers, renesas ethernet switch driver, the rest · Maintainers: Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds

After of_mdiobus_register succeeds, the mdio_np reference ownership is
  transferred to the mii_bus device (released via fwnode_handle_put during
  mdiobus_release). The success path calls of_node_put(mdio_np) which,
  combined with the automatic release via bus teardown, results in a double
  put and refcount underflow.

Move of_node_put so it is only called in the error path where
  of_mdiobus_register failed. On success, the bus driver manages the
  reference lifecycle.

Cc: stable@vger.kernel.org
Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for Ethernet Switch")
Signed-off-by: WenTao Liang <redacted>
---
 drivers/net/ethernet/renesas/rswitch_main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/renesas/rswitch_main.c b/drivers/net/ethernet/renesas/rswitch_main.c
index 6fe964816322..c33add28a70c 100644
--- a/drivers/net/ethernet/renesas/rswitch_main.c
+++ b/drivers/net/ethernet/renesas/rswitch_main.c
@@ -1387,13 +1387,13 @@ static int rswitch_mii_register(struct rswitch_device *rdev)
 	err = of_mdiobus_register(mii_bus, mdio_np);
 	if (err < 0) {
 		mdiobus_free(mii_bus);
-		goto out;
+		of_node_put(mdio_np);
+		return err;
 	}
 
 	rdev->etha->mii = mii_bus;
 
-out:
-	of_node_put(mdio_np);
+	return 0;
 
 	return err;
 }
-- 
2.39.5 (Apple Git-154)
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help