Commit aa914e9d authored by Miaoqian Lin's avatar Miaoqian Lin Committed by Hongbo Li
Browse files

net: altera: Fix refcount leak in altera_tse_mdio_create 

stable inclusion
from stable-v4.19.247
commit 5cd0e22fa11f4a21a8c09cc258f20b1474c95801
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBZ0
CVE: CVE-2022-49351

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5cd0e22fa11f4a21a8c09cc258f20b1474c95801



--------------------------------

[ Upstream commit 11ec18b1 ]

Every iteration of for_each_child_of_node() decrements
the reference count of the previous node.
When break from a for_each_child_of_node() loop,
we need to explicitly call of_node_put() on the child node when
not need anymore.
Add missing of_node_put() to avoid refcount leak.

Fixes: bbd2190c ("Altera TSE: Add main and header file for Altera Ethernet Driver")
Signed-off-by: default avatarMiaoqian Lin <linmq006@gmail.com>
Link: https://lore.kernel.org/r/20220607041144.7553-1-linmq006@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarHongbo Li <lihongbo22@huawei.com>
parent 3c67b39e

drivers/net/ethernet/altera/altera_tse_main.c

+5 −1
Original line number Diff line number Diff line
@@ -174,7 +174,8 @@ static int altera_tse_mdio_create(struct net_device *dev, unsigned int id) 
	mdio = mdiobus_alloc();

	if (mdio == NULL) {

		netdev_err(dev, "Error allocating MDIO bus\n");

		return -ENOMEM;

		ret = -ENOMEM;

		goto put_node;

	}



	mdio->name = ALTERA_TSE_RESOURCE_NAME;
@@ -191,6 +192,7 @@ static int altera_tse_mdio_create(struct net_device *dev, unsigned int id) 
			   mdio->id);

		goto out_free_mdio;

	}

	of_node_put(mdio_node);



	if (netif_msg_drv(priv))

		netdev_info(dev, "MDIO bus %s: created\n", mdio->id);
@@ -200,6 +202,8 @@ static int altera_tse_mdio_create(struct net_device *dev, unsigned int id) 
out_free_mdio:

	mdiobus_free(mdio);

	mdio = NULL;

put_node:

	of_node_put(mdio_node);

	return ret;

}