cpts_of_mux_clk_setup() takes a reference on the "cpts-refclk-mux" child
node that is only released on the mux_fail error path. When the mux clock
provider is registered successfully, the reference is leaked.
of_clk_add_hw_provider() keeps its own reference on the node, so release
the one taken here before returning.

Fixes: a3047a81ba13 ("net: ethernet: ti: cpts: add support for ext rftclk selection")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/ti/cpts.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
index 2ba4c8795d60..372cef13d81e 100644
--- a/drivers/net/ethernet/ti/cpts.c
+++ b/drivers/net/ethernet/ti/cpts.c
@@ -714,6 +714,8 @@ static int cpts_of_mux_clk_setup(struct cpts *cpts, struct device_node *node)
 		goto mux_fail;
 	}
 
+	of_node_put(refclk_np);
+
 	return ret;
 
 mux_fail:
-- 
2.34.1

On Thu, Sep 17, 2026 at 11:46:16AM +0000, Wentao Liang wrote:
> cpts_of_mux_clk_setup() takes a reference on the "cpts-refclk-mux" child
> node that is only released on the mux_fail error path. When the mux clock
> provider is registered successfully, the reference is leaked.
> of_clk_add_hw_provider() keeps its own reference on the node, so release
> the one taken here before returning.
> 
> Fixes: a3047a81ba13 ("net: ethernet: ti: cpts: add support for ext rftclk selection")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/ethernet/ti/cpts.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
> index 2ba4c8795d60..372cef13d81e 100644
> --- a/drivers/net/ethernet/ti/cpts.c
> +++ b/drivers/net/ethernet/ti/cpts.c
> @@ -714,6 +714,8 @@ static int cpts_of_mux_clk_setup(struct cpts *cpts, struct device_node *node)
>  		goto mux_fail;
>  	}
>  
> +	of_node_put(refclk_np);
> +
>  	return ret;

I believe that of_node_put() should not be added here, but
rather it should be added to cpts_clk_del_provider().

Otherwise, what ensures that the node hasn't been reclaimed
by the time cpts_clk_del_provider() runs?

-- 
pw-bot: changes-requested