of_mdio_find_bus() returns a mii_bus whose embedded struct device has
its reference count incremented. When ksz_mdio_register() fails after
the parent bus has been stored in dev->parent_mdio_bus, that reference
is never dropped, so the parent MDIO bus device leaks on every probe
failure.

Drop the reference before returning from the error path.

Fixes: 9afaf0eec2ab ("net: dsa: microchip: Refactor MDIO handling for side MDIO access")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/dsa/microchip/ksz_common.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index 144373e13bea..fcf3a29ffca3 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -2807,6 +2807,11 @@ static int ksz_mdio_register(struct ksz_device *dev)
 	}
 
 put_mdio_node:
+	if (ret && dev->parent_mdio_bus) {
+		put_device(&dev->parent_mdio_bus->dev);
+		dev->parent_mdio_bus = NULL;
+	}
+
 	of_node_put(mdio_np);
 	of_node_put(parent_bus_node);
 
-- 
2.34.1

On Thu, Sep 17, 2026 at 10:47:57AM +0000, Wentao Liang wrote:
> of_mdio_find_bus() returns a mii_bus whose embedded struct device has
> its reference count incremented. When ksz_mdio_register() fails after
> the parent bus has been stored in dev->parent_mdio_bus, that reference
> is never dropped, so the parent MDIO bus device leaks on every probe
> failure.
> 
> Drop the reference before returning from the error path.

What about the happy days path? Where is this reference dropped when
the driver is removed?

> 
> Fixes: 9afaf0eec2ab ("net: dsa: microchip: Refactor MDIO handling for side MDIO access")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/dsa/microchip/ksz_common.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
> index 144373e13bea..fcf3a29ffca3 100644
> --- a/drivers/net/dsa/microchip/ksz_common.c
> +++ b/drivers/net/dsa/microchip/ksz_common.c
> @@ -2807,6 +2807,11 @@ static int ksz_mdio_register(struct ksz_device *dev)
>  	}
>  
>  put_mdio_node:
> +	if (ret && dev->parent_mdio_bus) {
> +		put_device(&dev->parent_mdio_bus->dev);
> +		dev->parent_mdio_bus = NULL;

Is setting dev->parent_mdio_bus to NULL required? If an error is
returned, does it ever get used?

    Andrew

---
pw-bot: cr