net: bcmgenet: fix reference counting for phy node

For the fixed phy setup make sure to not overwrite a valid value of
phy_dn (that is holding a reference to a phy-handle) and also acquire a
reference to the MAC node to consistently return with the phy_dn pointer
holding a reference.

Also add the corresponding of_node_put in the error path and the remove
function.

Fixes: 9abf0c2b ("net: bcmgenet: use the new fixed PHY helpers")
Fixes: aa09677c ("net: bcmgenet: add MDIO routines")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/net/ethernet/broadcom/genet/bcmmii.c

@@ -303,12 +303,12 @@ static int bcmgenet_mii_probe(struct net_device *dev)
 	/* In the case of a fixed PHY, the DT node associated
 	 * to the PHY is the Ethernet MAC DT node.
 	 */
-	if (of_phy_is_fixed_link(dn)) {
+	if (!priv->phy_dn && of_phy_is_fixed_link(dn)) {
 		ret = of_phy_register_fixed_link(dn);
 		if (ret)
 			return ret;
 
-		priv->phy_dn = dn;
+		priv->phy_dn = of_node_get(dn);
 	}
 
 	phydev = of_phy_connect(dev, priv->phy_dn, bcmgenet_mii_setup, 0,
@@ -444,6 +444,7 @@ int bcmgenet_mii_init(struct net_device *dev)
 	return 0;
 
 out:
+	of_node_put(priv->phy_dn);
 	mdiobus_unregister(priv->mii_bus);
 out_free:
 	kfree(priv->mii_bus->irq);
@@ -455,6 +456,7 @@ void bcmgenet_mii_exit(struct net_device *dev)
 {
 	struct bcmgenet_priv *priv = netdev_priv(dev);
 
+	of_node_put(priv->phy_dn);
 	mdiobus_unregister(priv->mii_bus);
 	kfree(priv->mii_bus->irq);
 	mdiobus_free(priv->mii_bus);