From 08dfb3106c0de3a2bf0adb0191264bfff03ed821 Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 10:49:20 +0000 Subject: [PATCH] net: dsa: vitesse-vsc73xx: Fix SPI device reference leak in vsc73xx_spi_probe() spi_dev_get() takes a reference on the SPI device, but neither the probe error paths nor vsc73xx_spi_remove() ever release it, so the spi_device can never be freed after the driver has been unbound. Release the reference on both probe error paths and in remove(). Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path Signed-off-by: Wentao Liang Reviewed-by: Andrew Lunn Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260917104920.2147568-1-vulab@iscas.ac.cn Signed-off-by: Jakub Kicinski --- drivers/net/dsa/vitesse-vsc73xx-spi.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/dsa/vitesse-vsc73xx-spi.c b/drivers/net/dsa/vitesse-vsc73xx-spi.c index 85b9a0f51dd8..7b784320c41e 100644 --- a/drivers/net/dsa/vitesse-vsc73xx-spi.c +++ b/drivers/net/dsa/vitesse-vsc73xx-spi.c @@ -153,10 +153,15 @@ static int vsc73xx_spi_probe(struct spi_device *spi) ret = spi_setup(spi); if (ret < 0) { dev_err(dev, "spi setup failed.\n"); + spi_dev_put(vsc_spi->spi); return ret; } - return vsc73xx_probe(&vsc_spi->vsc); + ret = vsc73xx_probe(&vsc_spi->vsc); + if (ret) + spi_dev_put(vsc_spi->spi); + + return ret; } static void vsc73xx_spi_remove(struct spi_device *spi) @@ -167,6 +172,8 @@ static void vsc73xx_spi_remove(struct spi_device *spi) return; vsc73xx_remove(&vsc_spi->vsc); + + spi_dev_put(vsc_spi->spi); } static void vsc73xx_spi_shutdown(struct spi_device *spi)