[PATCH net-next 0/2] net: ixp4xx: fix OF node leaks

[PATCH net-next 0/2] net: ixp4xx: fix OF node leaks

[zhaofeng2]

From: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

ixp4xx_eth and ixp4xx_hss resolve their NPE and queue phandles with
of_parse_phandle_with_fixed_args(), which takes a reference on the
resolved device node.  Neither driver ever drops that reference, so
the NPE and queue manager device nodes are leaked on every probe
(and on every -EPROBE_DEFER retry in the ixp4xx_eth case, as the MDIO
check happens after the DT parsing).

This addresses part of the "bunch of pre-existing bugs in the area"
noted when a related probe deferral patch was set aside earlier [1].

[1] https://lore.kernel.org/netdev/20260831170858.7e23643e@kernel.org/

[PATCH net-next 1/2] net: ethernet: ixp4xx: fix OF node leaks in ixp4xx_of_get_platdata()

[zhaofeng2]

From: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

ixp4xx_of_get_platdata() resolves the NPE and the RX/TX-ready queue
phandles with of_parse_phandle_with_fixed_args(), which takes a
reference on the resolved device node, but the references are never
dropped, so the NPE and queue manager device nodes are leaked on every
probe.  Since the DT parsing happens before the -EPROBE_DEFER check
for the MDIO bus instance, the leak also repeats on every probe
deferral.

Drop the references with of_node_put() once the phandle argument has
been consumed.

Fixes: 95aafe911db6 ("net: ethernet: ixp4xx: Support device tree probing")
Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
---
 drivers/net/ethernet/xscale/ixp4xx_eth.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -1397,6 +1397,7 @@
 	}
 	/* NPE ID 0x00, 0x10, 0x20... */
 	plat->npe = (npe_spec.args[0] << 4);
+	of_node_put(npe_spec.np);
 
 	/* Check if this device has an MDIO bus */
 	mdio_np = of_get_child_by_name(np, "mdio");
@@ -1414,6 +1415,7 @@
 		return NULL;
 	}
 	plat->rxq = queue_spec.args[0];
+	of_node_put(queue_spec.np);
 
 	/* Get the txready queue as resource from queue manager */
 	ret = of_parse_phandle_with_fixed_args(np, "queue-txready", 1, 0,
@@ -1423,6 +1425,7 @@
 		return NULL;
 	}
 	plat->txreadyq = queue_spec.args[0];
+	of_node_put(queue_spec.np);
 
 	ret = of_get_mac_address(np, mac);
 	if (!ret) {

[PATCH net-next 2/2] net: ixp4xx_hss: fix OF node leaks in ixp4xx_hss_probe()

[zhaofeng2]

From: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

ixp4xx_hss_probe() resolves the NPE and the six TX/RX queue phandles
with of_parse_phandle_with_fixed_args(), which takes a reference on
the resolved device node, but the references are never dropped, so
the NPE and queue manager device nodes are leaked on every probe.

Drop the references with of_node_put() once the phandle argument has
been consumed.

Fixes: 35aefaad326b ("net: ixp4xx_hss: Convert to use DT probing")
Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
---
 drivers/net/wan/ixp4xx_hss.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -1426,6 +1426,7 @@
 		return dev_err_probe(dev, err, "no NPE engine specified\n");
 	/* NPE ID 0x00, 0x10, 0x20... */
 	port->npe = npe_request(npe_spec.args[0] << 4);
+	of_node_put(npe_spec.np);
 	if (!port->npe) {
 		dev_err(dev, "unable to obtain NPE instance\n");
 		return -ENODEV;
@@ -1437,36 +1438,42 @@
 	if (err)
 		return dev_err_probe(dev, err, "no txready queue phandle\n");
 	port->txreadyq = queue_spec.args[0];
+	of_node_put(queue_spec.np);
 	/* Get the RX trig queue as resource from queue manager */
 	err = of_parse_phandle_with_fixed_args(np, "intek,queue-chl-rxtrig", 1, 0,
 					       &queue_spec);
 	if (err)
 		return dev_err_probe(dev, err, "no rxtrig queue phandle\n");
 	port->rxtrigq = queue_spec.args[0];
+	of_node_put(queue_spec.np);
 	/* Get the RX queue as resource from queue manager */
 	err = of_parse_phandle_with_fixed_args(np, "intek,queue-pkt-rx", 1, 0,
 					       &queue_spec);
 	if (err)
 		return dev_err_probe(dev, err, "no RX queue phandle\n");
 	port->rxq = queue_spec.args[0];
+	of_node_put(queue_spec.np);
 	/* Get the TX queue as resource from queue manager */
 	err = of_parse_phandle_with_fixed_args(np, "intek,queue-pkt-tx", 1, 0,
 					       &queue_spec);
 	if (err)
 		return dev_err_probe(dev, err, "no RX queue phandle\n");
 	port->txq = queue_spec.args[0];
+	of_node_put(queue_spec.np);
 	/* Get the RX free queue as resource from queue manager */
 	err = of_parse_phandle_with_fixed_args(np, "intek,queue-pkt-rxfree", 1, 0,
 					       &queue_spec);
 	if (err)
 		return dev_err_probe(dev, err, "no RX free queue phandle\n");
 	port->rxfreeq = queue_spec.args[0];
+	of_node_put(queue_spec.np);
 	/* Get the TX done queue as resource from queue manager */
 	err = of_parse_phandle_with_fixed_args(np, "intek,queue-pkt-txdone", 1, 0,
 					       &queue_spec);
 	if (err)
 		return dev_err_probe(dev, err, "no TX done queue phandle\n");
 	port->txdoneq = queue_spec.args[0];
+	of_node_put(queue_spec.np);
 
 	/* Obtain all the line control GPIOs */
 	port->cts = devm_gpiod_get(dev, "cts", GPIOD_OUT_LOW);

Re: [PATCH net-next 0/2] net: ixp4xx: fix OF node leaks

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net-next 0/2] net: ixp4xx: fix OF node leaks

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 10 Nov 2026 15:08:00 +0800 you wrote:
> From: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
> 
> ixp4xx_eth and ixp4xx_hss resolve their NPE and queue phandles with
> of_parse_phandle_with_fixed_args(), which takes a reference on the
> resolved device node.  Neither driver ever drops that reference, so
> the NPE and queue manager device nodes are leaked on every probe
> (and on every -EPROBE_DEFER retry in the ixp4xx_eth case, as the MDIO
> check happens after the DT parsing).
> 
> [...]

Here is the summary with links:
  - [net-next,1/2] net: ethernet: ixp4xx: fix OF node leaks in ixp4xx_of_get_platdata()
    https://git.kernel.org/netdev/net-next/c/81d20448c14f
  - [net-next,2/2] net: ixp4xx_hss: fix OF node leaks in ixp4xx_hss_probe()
    https://git.kernel.org/netdev/net-next/c/37f53abe8ee6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html