Commit 2bd0d371 authored by Joe Hattori's avatar Joe Hattori Committed by Liu Jian
Browse files

net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() 

stable inclusion
from stable-v5.10.224
commit b7b8d9f5e679af60c94251fd6728dde34be69a71
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYL
CVE: CVE-2024-44971

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b7b8d9f5e679af60c94251fd6728dde34be69a71



-------------------------------------------------

[ Upstream commit e3862093ee93fcfbdadcb7957f5f8974fffa806a ]

bcm_sf2_mdio_register() calls of_phy_find_device() and then
phy_device_remove() in a loop to remove existing PHY devices.
of_phy_find_device() eventually calls bus_find_device(), which calls
get_device() on the returned struct device * to increment the refcount.
The current implementation does not decrement the refcount, which causes
memory leak.

This commit adds the missing phy_device_free() call to decrement the
refcount via put_device() to balance the refcount.

Fixes: 771089c2 ("net: dsa: bcm_sf2: Ensure that MDIO diversion is used")
Signed-off-by: default avatarJoe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Tested-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20240806011327.3817861-1-joe@pf.is.s.u-tokyo.ac.jp


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent 3e6d44ea

drivers/net/dsa/bcm_sf2.c

+3 −1
Original line number Diff line number Diff line
@@ -558,8 +558,10 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds) 
			of_remove_property(child, prop);



		phydev = of_phy_find_device(child);

		if (phydev)

		if (phydev) {

			phy_device_remove(phydev);

			phy_device_free(phydev);

		}

	}



	err = mdiobus_register(priv->slave_mii_bus);