From: Jinjie Ruan ruanjinjie@huawei.com

stable inclusion from stable-v6.6.51 commit 26928c8f00f6bb0e194f3957fe51c69d36838eb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYBT CVE: CVE-2024-46767

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...

--------------------------------

[ Upstream commit 2560db6ede1aaf162a73b2df43e0b6c5ed8819f7 ]

The call of of_get_child_by_name() will cause refcount incremented for leds, if it succeeds, it should call of_node_put() to decrease it, fix it.

Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Reviewed-by: Jonathan Cameron Jonathan.Cameron@huawei.com Signed-off-by: Jinjie Ruan ruanjinjie@huawei.com Reviewed-by: Andrew Lunn andrew@lunn.ch Link: https://patch.msgid.link/20240830022025.610844-1-ruanjinjie@huawei.com Signed-off-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Zhang Changzhong zhangchangzhong@huawei.com --- drivers/net/phy/phy_device.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index c895cd1..2e4bff6 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -3164,11 +3164,13 @@ static int of_phy_leds(struct phy_device *phydev) err = of_phy_led(phydev, led); if (err) { of_node_put(led); + of_node_put(leds); phy_leds_unregister(phydev); return err; } }

+ of_node_put(leds); return 0; }