The mdiobus allocated by tn40_mdiobus_init() has no primary firmware node so its firmware node pointer points to the secondary software node added by device_add_software_node() and whose reference is released by device_remove_software_node(). Drop the stray firmware node reference decrement on probe failure and driver unbind which leads to a use-after-free when deregistering the software node group as the parent MDIO node has been freed before the child PHY node. Fixes: 25b6a6d29d40 ("net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus") Cc: stable@vger.kernel.org # 6.15 Cc: Hans-Frieder Vogt Signed-off-by: Johan Hovold --- drivers/net/ethernet/tehuti/tn40_mdio.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/ethernet/tehuti/tn40_mdio.c b/drivers/net/ethernet/tehuti/tn40_mdio.c index fb1a4a2e4dbc..49951477ac05 100644 --- a/drivers/net/ethernet/tehuti/tn40_mdio.c +++ b/drivers/net/ethernet/tehuti/tn40_mdio.c @@ -157,7 +157,6 @@ void tn40_swnodes_cleanup(struct tn40_priv *priv) { /* cleanup of swnodes is only needed for AQR105-based cards */ if (priv->pdev->device == PCI_DEVICE_ID_TEHUTI_TN9510) { - fwnode_handle_put(dev_fwnode(&priv->mdio->dev)); device_remove_software_node(&priv->mdio->dev); software_node_unregister_node_group(priv->nodes.group); } -- 2.56.0