In dsa_loop_drv_probe(), a reference to the configured network device
is taken with dev_get_by_name().  This reference is dropped in
dsa_loop_drv_remove() on success, but if dsa_register_switch() fails,
the probe returns without releasing it, leaking the reference.

Fix this by dropping the reference with dev_put() when
dsa_register_switch() fails.

Fixes: 98cd1552ea27 ("net: dsa: Mock-up driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/dsa/dsa_loop.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
index 7058faf23592..b6b6fcffb406 100644
--- a/drivers/net/dsa/dsa_loop.c
+++ b/drivers/net/dsa/dsa_loop.c
@@ -389,6 +389,8 @@ static int dsa_loop_drv_probe(struct mdio_device *mdiodev)
 	if (!ret)
 		dev_info(&mdiodev->dev, "%s: 0x%0x\n",
 			 pdata->name, pdata->enabled_ports);
+	else
+		dev_put(ps->netdev);
 
 	return ret;
 }
-- 
2.34.1

On Thu, Sep 17, 2026 at 10:46:29AM +0000, Wentao Liang wrote:
> In dsa_loop_drv_probe(), a reference to the configured network device
> is taken with dev_get_by_name().  This reference is dropped in
> dsa_loop_drv_remove() on success, but if dsa_register_switch() fails,
> the probe returns without releasing it, leaking the reference.
> 
> Fix this by dropping the reference with dev_put() when
> dsa_register_switch() fails.
> 
> Fixes: 98cd1552ea27 ("net: dsa: Mock-up driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/dsa/dsa_loop.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
> index 7058faf23592..b6b6fcffb406 100644
> --- a/drivers/net/dsa/dsa_loop.c
> +++ b/drivers/net/dsa/dsa_loop.c
> @@ -389,6 +389,8 @@ static int dsa_loop_drv_probe(struct mdio_device *mdiodev)
>  	if (!ret)
>  		dev_info(&mdiodev->dev, "%s: 0x%0x\n",
>  			 pdata->name, pdata->enabled_ports);
> +	else
> +		dev_put(ps->netdev);
>  
>  	return ret;

Please turn the condition around to make it fit the usual error handling pattern


       ret = dsa_register_switch(ds);
       if (ret)
		dev_put(ps->netdev);
       else
  		dev_info(&mdiodev->dev, "%s: 0x%0x\n",
  			 pdata->name, pdata->enabled_ports);

    Andrew

---
pw-bot: cr