Patch "net: mv643xx_eth: fix an OF node reference leak" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: mv643xx_eth: fix an OF node reference leak

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-mv643xx_eth-fix-an-of-node-reference-leak.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 6799fa93f32455afee1a2d1de367c45aae14670d
Author: Joe Hattori <joe@xxxxxxxxxxxxxxxxxxxxx>
Date:   Sat Dec 21 17:14:48 2024 +0900

    net: mv643xx_eth: fix an OF node reference leak
    
    [ Upstream commit ad5c318086e2e23b577eca33559c5ebf89bc7eb9 ]
    
    Current implementation of mv643xx_eth_shared_of_add_port() calls
    of_parse_phandle(), but does not release the refcount on error. Call
    of_node_put() in the error path and in mv643xx_eth_shared_of_remove().
    
    This bug was found by an experimental verification tool that I am
    developing.
    
    Fixes: 76723bca2802 ("net: mv643xx_eth: add DT parsing support")
    Signed-off-by: Joe Hattori <joe@xxxxxxxxxxxxxxxxxxxxx>
    Link: https://patch.msgid.link/20241221081448.3313163-1-joe@xxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 3b129a1c3381..07e5051171a4 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -2708,9 +2708,15 @@ static struct platform_device *port_platdev[3];
 
 static void mv643xx_eth_shared_of_remove(void)
 {
+	struct mv643xx_eth_platform_data *pd;
 	int n;
 
 	for (n = 0; n < 3; n++) {
+		if (!port_platdev[n])
+			continue;
+		pd = dev_get_platdata(&port_platdev[n]->dev);
+		if (pd)
+			of_node_put(pd->phy_node);
 		platform_device_del(port_platdev[n]);
 		port_platdev[n] = NULL;
 	}
@@ -2773,8 +2779,10 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev,
 	}
 
 	ppdev = platform_device_alloc(MV643XX_ETH_NAME, dev_num);
-	if (!ppdev)
-		return -ENOMEM;
+	if (!ppdev) {
+		ret = -ENOMEM;
+		goto put_err;
+	}
 	ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
 	ppdev->dev.of_node = pnp;
 
@@ -2796,6 +2804,8 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev,
 
 port_err:
 	platform_device_put(ppdev);
+put_err:
+	of_node_put(ppd.phy_node);
 	return ret;
 }