On Fri, Nov 21, 2025 at 12:20:00PM +0800, Ma Ke wrote:

In ksz_mdio_register(), when of_mdio_find_bus() is called to get the parent MDIO bus, it increments the reference count of the underlying device. However, the reference are not released in error paths or during switch teardown, causing a reference leak.

Add put_device() in the error path of ksz_mdio_register() and ksz_teardown() to release the parent bus.

Found by code review.

Cc: stable@vger.kernel.org Fixes: 9afaf0eec2ab ("net: dsa: microchip: Refactor MDIO handling for side MDIO access") Signed-off-by: Ma Ke make24@iscas.ac.cn

---

drivers/net/dsa/microchip/ksz_common.c | 10 ++++++++++ 1 file changed, 10 insertions(+)

diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c index 933ae8dc6337..49c0420a6df8 100644 --- a/drivers/net/dsa/microchip/ksz_common.c +++ b/drivers/net/dsa/microchip/ksz_common.c @@ -2795,6 +2795,11 @@ static int ksz_mdio_register(struct ksz_device *dev) } put_mdio_node:

• if (ret && dev->parent_mdio_bus) {

• put_device(&dev->parent_mdio_bus->dev);
  

• dev->parent_mdio_bus = NULL;
  

• }
• of_node_put(mdio_np); of_node_put(parent_bus_node);

@@ -3110,6 +3115,11 @@ static void ksz_teardown(struct dsa_switch *ds) ksz_irq_free(&dev->girq); }

• if (dev->parent_mdio_bus) {

• put_device(&dev->parent_mdio_bus->dev);
  

• dev->parent_mdio_bus = NULL;
  

• }
• if (dev->dev_ops->teardown) dev->dev_ops->teardown(ds);

}

2.17.1

Thank you for the patch.

I see 2 problems:

1. I'm not sure that releasing the reference to the parent_mdio_bus device is compatible with devres, since the MDIO bus created by ksz_mdio_register() will continue to exist after we release the parent_mdio_bus reference. I think it would be better to remove devres, introduce ksz_mdio_unregister(), and only release the reference once our MDIO bus is unregistered.

2. Error path handling is incomplete:

ret = ksz_mdio_register(dev); if (ret < 0) { dev_err(dev->dev, "failed to register the mdio"); goto out_ptp_clock_unregister; }

ret = ksz_dcb_init(dev); if (ret) goto out_ptp_clock_unregister; // needs to call ksz_mdio_unregister()