mtk_star_probe() gets the PHY node from the "phy-handle" property with of_parse_phandle(). The helper takes a reference on the node it returns. The node is used by of_phy_connect() each time the netdevice is opened. That reference is never dropped. Every error return after the lookup leaks it. Unbind leaks it as well: the driver is devm-only and has no remove callback. Release it with a devm action, registered right after the lookup. The error paths and the unbind path then drop the node through the devm cleanup. Found during a code review of the OF node handling in ethernet drivers. Fixes: 8c7bd5a454ff ("net: ethernet: mtk-star-emac: new driver") Signed-off-by: Xia Yan --- Changes in v2: - Add the missing Fixes: tag. v1: https://lore.kernel.org/netdev/1794061182000.57993.3986467551914992480@cmss.chinamobile.com/ drivers/net/ethernet/mediatek/mtk_star_emac.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/net/ethernet/mediatek/mtk_star_emac.c b/drivers/net/ethernet/mediatek/mtk_star_emac.c index b83886a41121..bac4a24c5979 100644 --- a/drivers/net/ethernet/mediatek/mtk_star_emac.c +++ b/drivers/net/ethernet/mediatek/mtk_star_emac.c @@ -1501,6 +1501,11 @@ clk_bulk_disable_unprepare(MTK_STAR_NCLKS, priv->clks); } +static void mtk_star_of_node_put(void *data) +{ + of_node_put(data); +} + static int mtk_star_set_timing(struct mtk_star_priv *priv) { struct device *dev = mtk_star_get_dev(priv); @@ -1603,6 +1608,11 @@ return -ENODEV; } + ret = devm_add_action_or_reset(dev, mtk_star_of_node_put, + priv->phy_node); + if (ret) + return ret; + priv->rmii_rxc = of_property_read_bool(of_node, "mediatek,rmii-rxc"); priv->rx_inv = of_property_read_bool(of_node, "mediatek,rxc-inverse"); priv->tx_inv = of_property_read_bool(of_node, "mediatek,txc-inverse");