mtk_star_probe() gets the PHY node from the "phy-handle" property
with of_parse_phandle(). The helper takes a reference on the node it
returns. The node is used by of_phy_connect() each time the netdevice
is opened.
That reference is never dropped. Every error return after the lookup
leaks it. Unbind leaks it as well: the driver is devm-only and has no
remove callback.
Release it with a devm action, registered right after the lookup.
The error paths and the unbind path then drop the node through the
devm cleanup.
Found during a code review of the OF node handling in ethernet drivers.
Signed-off-by: Xia Yan <redacted>
---
drivers/net/ethernet/mediatek/mtk_star_emac.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/net/ethernet/mediatek/mtk_star_emac.c b/drivers/net/ethernet/mediatek/mtk_star_emac.c
index b83886a41121..bac4a24c5979 100644
--- a/drivers/net/ethernet/mediatek/mtk_star_emac.c
+++ b/drivers/net/ethernet/mediatek/mtk_star_emac.c
@@ -1501,6 +1501,11 @@
clk_bulk_disable_unprepare(MTK_STAR_NCLKS, priv->clks);
}
+static void mtk_star_of_node_put(void *data)
+{
+ of_node_put(data);
+}
+
static int mtk_star_set_timing(struct mtk_star_priv *priv)
{
struct device *dev = mtk_star_get_dev(priv);@@ -1603,6 +1608,11 @@
return -ENODEV;
}
+ ret = devm_add_action_or_reset(dev, mtk_star_of_node_put,
+ priv->phy_node);
+ if (ret)
+ return ret;
+
priv->rmii_rxc = of_property_read_bool(of_node, "mediatek,rmii-rxc");
priv->rx_inv = of_property_read_bool(of_node, "mediatek,rxc-inverse");
priv->tx_inv = of_property_read_bool(of_node, "mediatek,txc-inverse");