When of_find_net_device_by_node() successfully acquires a reference to a network device but the subsequent call to dsa_port_parse_cpu() fails, dsa_port_parse_of() returns without releasing the reference count on the network device.
of_find_net_device_by_node() increments the reference count of the returned structure, which should be balanced with a corresponding put_device() when the reference is no longer needed.
Found by code review.
Cc: stable@vger.kernel.org Fixes: 6ca80638b90c ("net: dsa: Use conduit and user terms") Signed-off-by: Ma Ke make24@iscas.ac.cn --- net/dsa/dsa.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c index 5b01a0e43ebe..632e0d716d62 100644 --- a/net/dsa/dsa.c +++ b/net/dsa/dsa.c @@ -1246,6 +1246,7 @@ static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn) struct device_node *ethernet = of_parse_phandle(dn, "ethernet", 0); const char *name = of_get_property(dn, "label", NULL); bool link = of_property_read_bool(dn, "link"); + int err;
dp->dn = dn;
@@ -1259,7 +1260,13 @@ static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn) return -EPROBE_DEFER;
user_protocol = of_get_property(dn, "dsa-tag-protocol", NULL); - return dsa_port_parse_cpu(dp, conduit, user_protocol); + err = dsa_port_parse_cpu(dp, conduit, user_protocol); + if (err) { + put_device(conduit); + return err; + } + + return 0; }
if (link)
On Fri, Nov 21, 2025 at 11:51:30AM +0800, Ma Ke wrote:
When of_find_net_device_by_node() successfully acquires a reference to a network device but the subsequent call to dsa_port_parse_cpu() fails, dsa_port_parse_of() returns without releasing the reference count on the network device.
of_find_net_device_by_node() increments the reference count of the returned structure, which should be balanced with a corresponding put_device() when the reference is no longer needed.
Found by code review.
Cc: stable@vger.kernel.org Fixes: 6ca80638b90c ("net: dsa: Use conduit and user terms")
Why did you pick this commit for the Fixes tag?
@@ -1259,7 +1260,13 @@ static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn) return -EPROBE_DEFER; user_protocol = of_get_property(dn, "dsa-tag-protocol", NULL);
return dsa_port_parse_cpu(dp, conduit, user_protocol);
err = dsa_port_parse_cpu(dp, conduit, user_protocol);if (err) {put_device(conduit);return err;}return 0;if (link) -- 2.17.1
You can simplify this to:
err = dsa_port_parse_cpu(dp, conduit, user_protocol); if (err) put_device(conduit);
return err;
https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html
Andrew
--- pw-bot: cr
Hi Ma,
kernel test robot noticed the following build errors:
[auto build test ERROR on net-next/main] [also build test ERROR on net/main linus/master v6.18-rc6 next-20251121] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/net-dsa-Fix-error-handl... base: net-next/main patch link: https://lore.kernel.org/r/20251121035130.16020-1-make24%40iscas.ac.cn patch subject: [PATCH] net: dsa: Fix error handling in dsa_port_parse_of config: i386-randconfig-004-20251121 (https://download.01.org/0day-ci/archive/20251122/202511220109.1PvI00Sr-lkp@i...) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251122/202511220109.1PvI00Sr-lkp@i...)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot lkp@intel.com | Closes: https://lore.kernel.org/oe-kbuild-all/202511220109.1PvI00Sr-lkp@intel.com/
All errors (new ones prefixed by >>):
net/dsa/dsa.c:1265:15: error: incompatible pointer types passing 'struct net_device *' to parameter of type 'struct device *' [-Werror,-Wincompatible-pointer-types]
1265 | put_device(conduit); | ^~~~~~~ include/linux/device.h:1181:32: note: passing argument to parameter 'dev' here 1181 | void put_device(struct device *dev); | ^ 1 error generated.
vim +1265 net/dsa/dsa.c
1243 1244 static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn) 1245 { 1246 struct device_node *ethernet = of_parse_phandle(dn, "ethernet", 0); 1247 const char *name = of_get_property(dn, "label", NULL); 1248 bool link = of_property_read_bool(dn, "link"); 1249 int err; 1250 1251 dp->dn = dn; 1252 1253 if (ethernet) { 1254 struct net_device *conduit; 1255 const char *user_protocol; 1256 1257 conduit = of_find_net_device_by_node(ethernet); 1258 of_node_put(ethernet); 1259 if (!conduit) 1260 return -EPROBE_DEFER; 1261 1262 user_protocol = of_get_property(dn, "dsa-tag-protocol", NULL); 1263 err = dsa_port_parse_cpu(dp, conduit, user_protocol); 1264 if (err) {
1265 put_device(conduit);
1266 return err; 1267 } 1268 1269 return 0; 1270 } 1271 1272 if (link) 1273 return dsa_port_parse_dsa(dp); 1274 1275 return dsa_port_parse_user(dp, name); 1276 } 1277
Hi Ma,
kernel test robot noticed the following build errors:
[auto build test ERROR on net-next/main] [also build test ERROR on net/main linus/master v6.18-rc6 next-20251121] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/net-dsa-Fix-error-handl... base: net-next/main patch link: https://lore.kernel.org/r/20251121035130.16020-1-make24%40iscas.ac.cn patch subject: [PATCH] net: dsa: Fix error handling in dsa_port_parse_of config: i386-allmodconfig (https://download.01.org/0day-ci/archive/20251122/202511220203.nggER5yL-lkp@i...) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251122/202511220203.nggER5yL-lkp@i...)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot lkp@intel.com | Closes: https://lore.kernel.org/oe-kbuild-all/202511220203.nggER5yL-lkp@intel.com/
All errors (new ones prefixed by >>):
net/dsa/dsa.c: In function 'dsa_port_parse_of':
net/dsa/dsa.c:1265:36: error: passing argument 1 of 'put_device' from incompatible pointer type [-Wincompatible-pointer-types]
1265 | put_device(conduit); | ^~~~~~~ | | | struct net_device * In file included from net/dsa/dsa.c:10: include/linux/device.h:1181:32: note: expected 'struct device *' but argument is of type 'struct net_device *' 1181 | void put_device(struct device *dev); | ~~~~~~~~~~~~~~~^~~
vim +/put_device +1265 net/dsa/dsa.c
1243 1244 static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn) 1245 { 1246 struct device_node *ethernet = of_parse_phandle(dn, "ethernet", 0); 1247 const char *name = of_get_property(dn, "label", NULL); 1248 bool link = of_property_read_bool(dn, "link"); 1249 int err; 1250 1251 dp->dn = dn; 1252 1253 if (ethernet) { 1254 struct net_device *conduit; 1255 const char *user_protocol; 1256 1257 conduit = of_find_net_device_by_node(ethernet); 1258 of_node_put(ethernet); 1259 if (!conduit) 1260 return -EPROBE_DEFER; 1261 1262 user_protocol = of_get_property(dn, "dsa-tag-protocol", NULL); 1263 err = dsa_port_parse_cpu(dp, conduit, user_protocol); 1264 if (err) {
1265 put_device(conduit);
1266 return err; 1267 } 1268 1269 return 0; 1270 } 1271 1272 if (link) 1273 return dsa_port_parse_dsa(dp); 1274 1275 return dsa_port_parse_user(dp, name); 1276 } 1277
…
returned structure, which should be balanced with a corresponding put_device() when the reference is no longer needed.
…
* Would a corresponding imperative wording become helpful for an improved change description? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Docu...
* How do you think about to omit an extra check for the variable “err” in the affected if branch because it can always be returned here?
* Would it be helpful to append parentheses to the function name in the summary phrase?
Regards, Markus
On Sat, Nov 22, 2025 at 08:58:12PM +0100, Markus Elfring wrote:
…
returned structure, which should be balanced with a corresponding put_device() when the reference is no longer needed.
…
Would a corresponding imperative wording become helpful for an improved change description? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Docu...
How do you think about to omit an extra check for the variable “err” in the affected if branch because it can always be returned here?
Would it be helpful to append parentheses to the function name in the summary phrase?
Regards, Markus
Hi,
This is the semi-friendly patch-bot of Greg Kroah-Hartman.
Markus, you seem to have sent a nonsensical or otherwise pointless review comment to a patch submission on a Linux kernel developer mailing list. I strongly suggest that you not do this anymore. Please do not bother developers who are actively working to produce patches and features with comments that, in the end, are a waste of time.
Patch submitter, please ignore Markus's suggestion; you do not need to follow it at all. The person/bot/AI that sent it is being ignored by almost all Linux kernel maintainers for having a persistent pattern of behavior of producing distracting and pointless commentary, and inability to adapt to feedback. Please feel free to also ignore emails from them.
thanks,
greg k-h's patch email bot
linux-stable-mirror@lists.linaro.org
-
Andrew Lunn -
Greg KH -
kernel test robot -
Ma Ke -
Markus Elfring