3 files changed, 43 insertions, 11 deletions

diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 76e3800765f8..c59fa5d9c22c 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -634,6 +634,10 @@ static void dsa_of_free_platform_data(struct dsa_platform_data *pd)
                         port_index++;
                 }
                 kfree(pd->chip[i].rtable);
+
+                /* Drop our reference to the MDIO bus device */
+                if (pd->chip[i].host_dev)
+                        put_device(pd->chip[i].host_dev);
         }
         kfree(pd->chip);
 }
@@ -661,16 +665,22 @@ static int dsa_of_probe(struct device *dev)
                 return -EPROBE_DEFER;
 
         ethernet = of_parse_phandle(np, "dsa,ethernet", 0);
-        if (!ethernet)
-                return -EINVAL;
+        if (!ethernet) {
+                ret = -EINVAL;
+                goto out_put_mdio;
+        }
 
         ethernet_dev = of_find_net_device_by_node(ethernet);
-        if (!ethernet_dev)
-                return -EPROBE_DEFER;
+        if (!ethernet_dev) {
+                ret = -EPROBE_DEFER;
+                goto out_put_mdio;
+        }
 
         pd = kzalloc(sizeof(*pd), GFP_KERNEL);
-        if (!pd)
-                return -ENOMEM;
+        if (!pd) {
+                ret = -ENOMEM;
+                goto out_put_ethernet;
+        }
 
         dev->platform_data = pd;
         pd->of_netdev = ethernet_dev;
@@ -691,7 +701,9 @@ static int dsa_of_probe(struct device *dev)
                 cd = &pd->chip[chip_index];
 
                 cd->of_node = child;
-                cd->host_dev = &mdio_bus->dev;
+
+                /* When assigning the host device, increment its refcount */
+                cd->host_dev = get_device(&mdio_bus->dev);
 
                 sw_addr = of_get_property(child, "reg", NULL);
                 if (!sw_addr)
@@ -711,6 +723,12 @@ static int dsa_of_probe(struct device *dev)
                                 ret = -EPROBE_DEFER;
                                 goto out_free_chip;
                         }
+
+                        /* Drop the mdio_bus device ref, replacing the host
+                         * device with the mdio_bus_switch device, keeping
+                         * the refcount from of_mdio_find_bus() above.
+                         */
+                        put_device(cd->host_dev);
                         cd->host_dev = &mdio_bus_switch->dev;
                 }
 
@@ -744,6 +762,10 @@ static int dsa_of_probe(struct device *dev)
                 }
         }
 
+        /* The individual chips hold their own refcount on the mdio bus,
+         * so drop ours */
+        put_device(&mdio_bus->dev);
+
         return 0;
 
 out_free_chip:
@@ -751,6 +773,10 @@ out_free_chip:
 out_free:
         kfree(pd);
         dev->platform_data = NULL;
+out_put_ethernet:
+        put_device(&ethernet_dev->dev);
+out_put_mdio:
+        put_device(&mdio_bus->dev);
         return ret;
 }
 
@@ -762,6 +788,7 @@ static void dsa_of_remove(struct device *dev)
                 return;
 
         dsa_of_free_platform_data(pd);
+        put_device(&pd->of_netdev->dev);
         kfree(pd);
 }
 #else
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index cce97385f743..7d91f4612ac0 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -458,12 +458,17 @@ static int dsa_slave_stp_update(struct net_device *dev, u8 state)
 static int dsa_slave_port_attr_set(struct net_device *dev,
                                    struct switchdev_attr *attr)
 {
-        int ret = 0;
+        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_switch *ds = p->parent;
+        int ret;
 
         switch (attr->id) {
         case SWITCHDEV_ATTR_PORT_STP_STATE:
-                if (attr->trans == SWITCHDEV_TRANS_COMMIT)
-                        ret = dsa_slave_stp_update(dev, attr->u.stp_state);
+                if (attr->trans == SWITCHDEV_TRANS_PREPARE)
+                        ret = ds->drv->port_stp_update ? 0 : -EOPNOTSUPP;
+                else
+                        ret = ds->drv->port_stp_update(ds, p->port,
+                                                       attr->u.stp_state);
                 break;
         default:
                 ret = -EOPNOTSUPP;
diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c
index d25efc93d8f1..b6ca0890d018 100644
--- a/net/dsa/tag_trailer.c
+++ b/net/dsa/tag_trailer.c
@@ -78,7 +78,7 @@ static int trailer_rcv(struct sk_buff *skb, struct net_device *dev,
 
         trailer = skb_tail_pointer(skb) - 4;
         if (trailer[0] != 0x80 || (trailer[1] & 0xf8) != 0x00 ||
-            (trailer[3] & 0xef) != 0x00 || trailer[3] != 0x00)
+            (trailer[2] & 0xef) != 0x00 || trailer[3] != 0x00)
                 goto out_drop;
 
         source_port = trailer[1] & 7;