mv88e6xxx_probe() uses the referenced network device provided through platform data, but the remove path does not drop the corresponding reference. The probe failure path correctly calls dev_put() for pdata->netdev. However, after a successful probe, mv88e6xxx_remove() tears down the switch resources without releasing this reference, leaving the network device reference count unbalanced after driver removal. Call dev_put() in mv88e6xxx_remove() after the switch resources have been torn down. This issue was found by manual code inspection. Fixes: 877b7cb0b6f2 ("net: dsa: mv88e6xxx: Add minimal platform_data support") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/net/dsa/mv88e6xxx/chip.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c index 80b877c74513..e4394af2a3a2 100644 --- a/drivers/net/dsa/mv88e6xxx/chip.c +++ b/drivers/net/dsa/mv88e6xxx/chip.c @@ -7464,6 +7464,7 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev) static void mv88e6xxx_remove(struct mdio_device *mdiodev) { + struct dsa_mv88e6xxx_pdata *pdata = mdiodev->dev.platform_data; struct dsa_switch *ds = dev_get_drvdata(&mdiodev->dev); struct mv88e6xxx_chip *chip; @@ -7486,6 +7487,9 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev) mv88e6xxx_irq_poll_free(chip); mv88e6xxx_phy_destroy(chip); + + if (pdata) + dev_put(pdata->netdev); } static void mv88e6xxx_shutdown(struct mdio_device *mdiodev) -- 2.43.0