of_node_get() takes a reference on the FMan device node. That reference is released neither on the success path, which returns straight after of_platform_populate(), nor on the failure paths that jump to fman_free without going through fman_node_put(). Neither read_dts_node() nor its caller keeps fm_node around to release it later. Release the reference on the success path, and route the remaining failure paths through fman_node_put(). The latter leaves the fman_free label without any user, so drop it as well: fman_node_put already falls through to kfree(fman). The candidate was found with static analysis tools; DeepSeek and GPT-6.1 Sol were used to audit it and to help prepare this fix. Fixes: ecb239d96d36 ("ethernet: fman: fix wrong of_node_put() in probe function") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- Changes in v2: - Remove the fman_free label, which no longer has a user once the failure paths go through fman_node_put(). With W=1 the leftover label is an -Werror=unused-label build failure, as Simon reported. - Rebuilt with W=1 on v7.4-rc1 (x86_64 defconfig + COMPILE_TEST, CONFIG_FSL_FMAN=m); drivers/net/ethernet/freescale/fman/ now builds without warnings. - Link to v1: https://lore.kernel.org/all/20260917110342.2148155-1-vulab@iscas.ac.cn/ - Sorry for the late reply, and thanks for catching the build failure. drivers/net/ethernet/freescale/fman/fman.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c index 46cc28895e56..5507002097fd 100644 --- a/drivers/net/ethernet/freescale/fman/fman.c +++ b/drivers/net/ethernet/freescale/fman/fman.c @@ -2760,7 +2760,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev) err = -EINVAL; dev_err(&of_dev->dev, "%s: could not find MURAM node\n", __func__); - goto fman_free; + goto fman_node_put; } err = of_address_to_resource(muram_node, 0, @@ -2769,7 +2769,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev) of_node_put(muram_node); dev_err(&of_dev->dev, "%s: of_address_to_resource() = %d\n", __func__, err); - goto fman_free; + goto fman_node_put; } of_node_put(muram_node); @@ -2779,7 +2779,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev) if (err < 0) { dev_err(&of_dev->dev, "%s: irq %d allocation failed (error = %d)\n", __func__, irq, err); - goto fman_free; + goto fman_node_put; } if (fman->dts_params.err_irq != 0) { @@ -2789,7 +2789,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev) if (err < 0) { dev_err(&of_dev->dev, "%s: irq %d allocation failed (error = %d)\n", __func__, fman->dts_params.err_irq, err); - goto fman_free; + goto fman_node_put; } } @@ -2797,7 +2797,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev) if (IS_ERR(base_addr)) { err = PTR_ERR(base_addr); dev_err(&of_dev->dev, "%s: devm_ioremap() failed\n", __func__); - goto fman_free; + goto fman_node_put; } fman->dts_params.base_addr = base_addr; @@ -2809,7 +2809,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev) if (err) { dev_err(&of_dev->dev, "%s: of_platform_populate() failed\n", __func__); - goto fman_free; + goto fman_node_put; } #ifdef CONFIG_DPAA_ERRATUM_A050385 @@ -2817,11 +2817,12 @@ static struct fman *read_dts_node(struct platform_device *of_dev) of_property_read_bool(fm_node, "fsl,erratum-a050385"); #endif + of_node_put(fm_node); + return fman; fman_node_put: of_node_put(fm_node); -fman_free: kfree(fman); return ERR_PTR(err); } -- 2.43.0