Re: [PATCH v2] fix: net: renesas: rswitch_mii_register: fix double of_node_put after of_mdiobus_register

2026年6月27日 00:10，Andrew Lunn [off-list ref] 写道：

On Fri, Jun 26, 2026 at 11:25:50PM +0800, WenTao Liang wrote:

quoted

After of_mdiobus_register succeeds, the mdio_np reference ownership is
 transferred to the mii_bus device (released via fwnode_handle_put during
 mdiobus_release). The success path calls of_node_put(mdio_np) which,
 combined with the automatic release via bus teardown, results in a double
 put and refcount underflow.

Move of_node_put so it is only called in the error path where
 of_mdiobus_register failed. On success, the bus driver manages the
 reference lifecycle.

Please stop with these patches.

First please read:

https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html

and

https://docs.kernel.org/process/submitting-patches.html

You are getting a lot of things wrong. 

* don’t repost your patches within one 24h period
* Don't thread new versions of a patch to the old one
* Include version history, how is v2 different to v1
* When you see your own patch is broken, reply with NACK, and explain
 what is wrong with it.

Until you learn how to correctly submit patches, please only submit
them one at a time, get it accepted, and move onto the next. Otherwise
you are wasting peoples time, and getting yourself a bad reputation.

    Andrew

Hi Andrew,

Thank you for your careful review and for pointing out this issue. You are
absolutely correct — my previous analysis was flawed, and I appreciate you
taking the time to clarify.

Let me address your concerns:

1. On the double of_node_put():
   You are right. In the current error path, if mdiobus_register() succeeds
   and later macb_mii_probe() fails, the code jumps to err_out_unregister_bus,
   which calls mdiobus_unregister() and then mdiobus_free().
   - mdiobus_free() indeed releases the reference to the device node (via
     put_device()).
   - Adding an explicit of_node_put() in that same path would indeed result
     in a double decrement, which is incorrect and could lead to use-after-free
     or refcount underflow.

2. On the risk of untested patches:
   You are right to be cautious. I do not have access to the specific hardware
   to test this change, and I should have been more careful in reasoning about
   the reference counting semantics. I will refrain from submitting further
   patches in this area without proper testing or more thorough review of the
   existing code paths.

3. Proposed way forward:
   I will withdraw this patch for now. If I find a way to test it or gain more
   confidence through static analysis and documentation, I will resubmit with
   a clearer explanation and, ideally, test results.

Again, thank you for your diligence. I apologize for the noise and any extra
work this may have caused.

Please let me know if there is anything else I can clarify or help with.

Best regards,

WenTao Liang