[PATCH net] net: tn40xx: fix swnode use-after-free on probe failure

[Johan Hovold <johan@kernel.org>]

The mdiobus allocated by tn40_mdiobus_init() has no primary firmware
node so its firmware node pointer points to the secondary software node
added by device_add_software_node() and whose reference is released by
device_remove_software_node().

Drop the stray firmware node reference decrement on probe failure and
driver unbind which leads to a use-after-free when deregistering the
software node group as the parent MDIO node has been freed before the
child PHY node.

Fixes: 25b6a6d29d40 ("net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus")
Cc: stable@vger.kernel.org	# 6.15
Cc: Hans-Frieder Vogt <hfdevel@gmx.net>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/net/ethernet/tehuti/tn40_mdio.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/ethernet/tehuti/tn40_mdio.c b/drivers/net/ethernet/tehuti/tn40_mdio.c
index fb1a4a2e4dbc..49951477ac05 100644
--- a/drivers/net/ethernet/tehuti/tn40_mdio.c
+++ b/drivers/net/ethernet/tehuti/tn40_mdio.c
@@ -157,7 +157,6 @@ void tn40_swnodes_cleanup(struct tn40_priv *priv)
 {
 	/* cleanup of swnodes is only needed for AQR105-based cards */
 	if (priv->pdev->device == PCI_DEVICE_ID_TEHUTI_TN9510) {
-		fwnode_handle_put(dev_fwnode(&priv->mdio->dev));
 		device_remove_software_node(&priv->mdio->dev);
 		software_node_unregister_node_group(priv->nodes.group);
 	}
-- 
2.56.0