[PATCH] net: stmmac: platform: fix of_node leak when breaking RX queue loop

[PATCH] net: stmmac: platform: fix of_node leak when breaking RX queue loop

[Linkai Gong]

for_each_child_of_node() on the RX queues breaks once enough queues are
parsed, which leaves the current child referenced. The TX loop then
overwrites q_node, so that reference is never dropped.

of_node_put() the child before breaking. The TX loop already drops its
last reference via the of_node_put(q_node) at the out label.

Fixes: d976a525c371 ("net: stmmac: multiple queues dt configuration")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index dc5f951a311d..66a048ecadb0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -170,8 +170,11 @@ static int stmmac_mtl_setup(struct platform_device *pdev,
 
 	/* Processing individual RX queue config */
 	for_each_child_of_node(rx_node, q_node) {
-		if (queue >= plat->rx_queues_to_use)
+		if (queue >= plat->rx_queues_to_use) {
+			of_node_put(q_node);
+			q_node = NULL;
 			break;
+		}
 
 		if (of_property_read_bool(q_node, "snps,dcb-algorithm"))
 			plat->rx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB;
-- 
2.25.1

Re: [PATCH] net: stmmac: platform: fix of_node leak when breaking RX queue loop

[Andrew Lunn]

On Wed, Aug 19, 2026 at 03:32:58PM +0800, Linkai Gong wrote:
> for_each_child_of_node() on the RX queues breaks once enough queues are
> parsed, which leaves the current child referenced. The TX loop then
> overwrites q_node, so that reference is never dropped.
> 
> of_node_put() the child before breaking. The TX loop already drops its
> last reference via the of_node_put(q_node) at the out label.
> 
> Fixes: d976a525c371 ("net: stmmac: multiple queues dt configuration")
> Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> index dc5f951a311d..66a048ecadb0 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> @@ -170,8 +170,11 @@ static int stmmac_mtl_setup(struct platform_device *pdev,
>  
>  	/* Processing individual RX queue config */
>  	for_each_child_of_node(rx_node, q_node) {
> -		if (queue >= plat->rx_queues_to_use)
> +		if (queue >= plat->rx_queues_to_use) {
> +			of_node_put(q_node);
> +			q_node = NULL;
>  			break;
> +		}

Why not for_each_child_of_node_scoped()?

Also, does this bother anybody? I think this should be for net-next.

And while we are looking at this, what about:

https://elixir.bootlin.com/linux/v7.2/source/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c#L232

    Andrew

---
pw-bot: cr

Re: [PATCH] net: stmmac: platform: fix of_node leak when breaking RX queue loop

[Linkai Gong]

On Wed, Aug 19, 2026 at 15:00:26 +0200, Andrew Lunn wrote:
> Why not for_each_child_of_node_scoped()?

Yes, that is cleaner. I will convert both loops.

> Also, does this bother anybody? I think this should be for net-next.

Agreed. It only leaks when DT has more queue children than
rx-queues-to-use. v2 is for net-next.

> And while we are looking at this, what about:
>
> https://elixir.bootlin.com/linux/v7.2/source/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c#L232

That TX loop has the same break. It currently survives because
of_node_put(q_node) at the out label drops the last TX child.
Switching both loops to the scoped helper also covers that.

I will send a v2.

Thanks,
Linkai

[PATCH net-next v2] net: stmmac: platform: use scoped child loops in stmmac_mtl_setup()

[Linkai Gong]

for_each_child_of_node() takes a reference on the current child. Breaking
out of the RX loop leaks that node because the TX loop then overwrites
q_node. The TX loop has the same break, and only happens to be safe
because of_node_put(q_node) at the out label drops the last TX child.

Use for_each_child_of_node_scoped() for both loops so the child is put
on every exit, including break, and drop the out-label put of q_node.

Fixes: d976a525c371 ("net: stmmac: multiple queues dt configuration")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
v2:
- Use for_each_child_of_node_scoped() for RX and TX (Andrew Lunn)
- Target net-next

 drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index dc5f951a311d..c0ffee11e0a0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -130,7 +130,6 @@ static int stmmac_axi_setup(struct platform_device *pdev)
 static int stmmac_mtl_setup(struct platform_device *pdev,
 			    struct plat_stmmacenet_data *plat)
 {
-	struct device_node *q_node;
 	struct device_node *rx_node;
 	struct device_node *tx_node;
 	u8 queue = 0;
@@ -169,7 +168,7 @@ static int stmmac_mtl_setup(struct platform_device *pdev,
 		plat->rx_sched_algorithm = MTL_RX_ALGORITHM_SP;
 
 	/* Processing individual RX queue config */
-	for_each_child_of_node(rx_node, q_node) {
+	for_each_child_of_node_scoped(rx_node, q_node) {
 		if (queue >= plat->rx_queues_to_use)
 			break;
 
@@ -227,7 +226,7 @@ static int stmmac_mtl_setup(struct platform_device *pdev,
 	queue = 0;
 
 	/* Processing individual TX queue config */
-	for_each_child_of_node(tx_node, q_node) {
+	for_each_child_of_node_scoped(tx_node, q_node) {
 		if (queue >= plat->tx_queues_to_use)
 			break;
 
@@ -276,7 +275,6 @@ static int stmmac_mtl_setup(struct platform_device *pdev,
 out:
 	of_node_put(rx_node);
 	of_node_put(tx_node);
-	of_node_put(q_node);
 
 	return ret;
 }
-- 
2.25.1

Re: [PATCH net-next v2] net: stmmac: platform: use scoped child loops in stmmac_mtl_setup()

[Paolo Abeni]

On 8/20/26 3:23 AM, Linkai Gong wrote:
> for_each_child_of_node() takes a reference on the current child. Breaking
> out of the RX loop leaks that node because the TX loop then overwrites
> q_node. The TX loop has the same break, and only happens to be safe
> because of_node_put(q_node) at the out label drops the last TX child.
> 
> Use for_each_child_of_node_scoped() for both loops so the child is put
> on every exit, including break, and drop the out-label put of q_node.
> 
> Fixes: d976a525c371 ("net: stmmac: multiple queues dt configuration")
> Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
## Form letter - net-next-closed

We have already submitted our pull request with net-next material for v7.3,
and therefore net-next is closed for new drivers, features, code refactoring
and optimizations. We are currently accepting bug fixes only.

Please repost when net-next reopens after Aug 31st.

RFC patches sent for review only are obviously welcome at any time.

See: https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#development-cycle