net: stmmac: platform: fix of_node leak when breaking RX queue loop

[PATCH] net: stmmac: platform: fix of_node leak when breaking RX queue loop

Posted by Linkai Gong 1 month, 1 week ago

for_each_child_of_node() on the RX queues breaks once enough queues are
parsed, which leaves the current child referenced. The TX loop then
overwrites q_node, so that reference is never dropped.

of_node_put() the child before breaking. The TX loop already drops its
last reference via the of_node_put(q_node) at the out label.

Fixes: d976a525c371 ("net: stmmac: multiple queues dt configuration")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index dc5f951a311d..66a048ecadb0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -170,8 +170,11 @@ static int stmmac_mtl_setup(struct platform_device *pdev,
 
 	/* Processing individual RX queue config */
 	for_each_child_of_node(rx_node, q_node) {
-		if (queue >= plat->rx_queues_to_use)
+		if (queue >= plat->rx_queues_to_use) {
+			of_node_put(q_node);
+			q_node = NULL;
 			break;
+		}
 
 		if (of_property_read_bool(q_node, "snps,dcb-algorithm"))
 			plat->rx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB;
-- 
2.25.1

Re: [PATCH] net: stmmac: platform: fix of_node leak when breaking RX queue loop

Posted by Andrew Lunn 1 month, 1 week ago

On Wed, Aug 19, 2026 at 03:32:58PM +0800, Linkai Gong wrote:
> for_each_child_of_node() on the RX queues breaks once enough queues are
> parsed, which leaves the current child referenced. The TX loop then
> overwrites q_node, so that reference is never dropped.
> 
> of_node_put() the child before breaking. The TX loop already drops its
> last reference via the of_node_put(q_node) at the out label.
> 
> Fixes: d976a525c371 ("net: stmmac: multiple queues dt configuration")
> Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> index dc5f951a311d..66a048ecadb0 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
> @@ -170,8 +170,11 @@ static int stmmac_mtl_setup(struct platform_device *pdev,
>  
>  	/* Processing individual RX queue config */
>  	for_each_child_of_node(rx_node, q_node) {
> -		if (queue >= plat->rx_queues_to_use)
> +		if (queue >= plat->rx_queues_to_use) {
> +			of_node_put(q_node);
> +			q_node = NULL;
>  			break;
> +		}

Why not for_each_child_of_node_scoped()?

Also, does this bother anybody? I think this should be for net-next.

And while we are looking at this, what about:

https://elixir.bootlin.com/linux/v7.2/source/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c#L232

    Andrew

---
pw-bot: cr