[PATCH net v3] net: mdiobus: fix double put fwnode in the error path

[PATCH net v3] net: mdiobus: fix double put fwnode in the error path

[Yang Yingliang]

If phy_device_register() or fwnode_mdiobus_phy_device_register()
fail, phy_device_free() is called, the device refcount is decreased
to 0, then fwnode_handle_put() will be called in phy_device_release(),
but in the error path, fwnode_handle_put() has already been called,
so set fwnode to NULL after fwnode_handle_put() in the error path to
avoid double put.

Fixes: cdde1560118f ("net: mdiobus: fix unbalanced node reference count")
Reported-by: Zeng Heng <zengheng4@huawei.com>
Tested-by: Zeng Heng <zengheng4@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
v2 -> v3:
  set fwnode to NULL before calling fwnode_handle_put()

v1 -> v2:
  Don't remove fwnode_handle_put() in the error path,
  set fwnode to NULL avoid double put.
---
 drivers/net/mdio/fwnode_mdio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mdio/fwnode_mdio.c b/drivers/net/mdio/fwnode_mdio.c
index eb344f6d4a7b..b782c35c4ac1 100644
--- a/drivers/net/mdio/fwnode_mdio.c
+++ b/drivers/net/mdio/fwnode_mdio.c
@@ -98,6 +98,7 @@ int fwnode_mdiobus_phy_device_register(struct mii_bus *mdio,
 	 */
 	rc = phy_device_register(phy);
 	if (rc) {
+		device_set_node(&phy->mdio.dev, NULL);
 		fwnode_handle_put(child);
 		return rc;
 	}
@@ -153,7 +154,8 @@ int fwnode_mdiobus_register_phy(struct mii_bus *bus,
 		/* All data is now stored in the phy struct, so register it */
 		rc = phy_device_register(phy);
 		if (rc) {
-			fwnode_handle_put(phy->mdio.dev.fwnode);
+			phy->mdio.dev.fwnode = NULL;
+			fwnode_handle_put(child);
 			goto clean_phy;
 		}
 	} else if (is_of_node(child)) {
-- 
2.25.1

Re: [PATCH net v3] net: mdiobus: fix double put fwnode in the error path

[Zeng Heng]

On 2022/12/2 13:18, Yang Yingliang wrote:
> If phy_device_register() or fwnode_mdiobus_phy_device_register()
> fail, phy_device_free() is called, the device refcount is decreased
> to 0, then fwnode_handle_put() will be called in phy_device_release(),
> but in the error path, fwnode_handle_put() has already been called,
> so set fwnode to NULL after fwnode_handle_put() in the error path to
> avoid double put.
>
> Fixes: cdde1560118f ("net: mdiobus: fix unbalanced node reference count")
> Reported-by: Zeng Heng <zengheng4@huawei.com>
> Tested-by: Zeng Heng <zengheng4@huawei.com>
> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
> ---
> v2 -> v3:
>    set fwnode to NULL before calling fwnode_handle_put()
>
> v1 -> v2:
>    Don't remove fwnode_handle_put() in the error path,
>    set fwnode to NULL avoid double put.
> ---
>   drivers/net/mdio/fwnode_mdio.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/mdio/fwnode_mdio.c b/drivers/net/mdio/fwnode_mdio.c
> index eb344f6d4a7b..b782c35c4ac1 100644
> --- a/drivers/net/mdio/fwnode_mdio.c
> +++ b/drivers/net/mdio/fwnode_mdio.c
> @@ -98,6 +98,7 @@ int fwnode_mdiobus_phy_device_register(struct mii_bus *mdio,
>   	 */
>   	rc = phy_device_register(phy);
>   	if (rc) {
> +		device_set_node(&phy->mdio.dev, NULL);
>   		fwnode_handle_put(child);
>   		return rc;
>   	}
> @@ -153,7 +154,8 @@ int fwnode_mdiobus_register_phy(struct mii_bus *bus,
>   		/* All data is now stored in the phy struct, so register it */
>   		rc = phy_device_register(phy);
>   		if (rc) {
> -			fwnode_handle_put(phy->mdio.dev.fwnode);
> +			phy->mdio.dev.fwnode = NULL;
> +			fwnode_handle_put(child);
>   			goto clean_phy;
>   		}
>   	} else if (is_of_node(child)) {

Reviewed-by: Zeng Heng <zengheng4@huawei.com>

Tested-by: Zeng Heng <zengheng4@huawei.com>

Re: [PATCH net v3] net: mdiobus: fix double put fwnode in the error path

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:

On Fri, 2 Dec 2022 13:18:33 +0800 you wrote:
> If phy_device_register() or fwnode_mdiobus_phy_device_register()
> fail, phy_device_free() is called, the device refcount is decreased
> to 0, then fwnode_handle_put() will be called in phy_device_release(),
> but in the error path, fwnode_handle_put() has already been called,
> so set fwnode to NULL after fwnode_handle_put() in the error path to
> avoid double put.
> 
> [...]

Here is the summary with links:
  - [net,v3] net: mdiobus: fix double put fwnode in the error path
    https://git.kernel.org/netdev/net/c/165df24186ec

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html