[PATCH net v4 6/6] net: phy: avoid double-free after LED trigger registration failure
From: Xuanqiang Luo <hidden>
Date: 2026-08-21 07:04:52
Also in:
lkml
Subsystem:
ethernet phy library, networking drivers, the rest · Maintainers:
Andrew Lunn, Heiner Kallweit, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
From: Xuanqiang Luo <redacted>
When a speed trigger registration fails, phy_led_triggers_register() frees
phy_led_triggers but leaves the pointer set to the freed allocation. It
then clears phy_num_led_triggers.
phy_probe() ignores this error. If device-tree LED setup then fails, its
error path calls phy_led_triggers_unregister(). The zero trigger count
skips the per-trigger unregister loop, but the helper still frees the
dangling pointer.
Clear the pointer after partial registration cleanup and make
phy_led_triggers_unregister() walk and free the array only while it is
present.
Fixes: b7f0ee992adf ("net: phy: leds: fix memory leak")
Signed-off-by: Xuanqiang Luo <redacted>
---
drivers/net/phy/phy_led_triggers.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c
index 4eb7716bb9d6c..ff6e518395be0 100644
--- a/drivers/net/phy/phy_led_triggers.c
+++ b/drivers/net/phy/phy_led_triggers.c@@ -126,6 +126,7 @@ int phy_led_triggers_register(struct phy_device *phy) while (i--) phy_led_trigger_unregister(&phy->phy_led_triggers[i]); kfree(phy->phy_led_triggers); + phy->phy_led_triggers = NULL; out_unreg_link: phy_led_trigger_unregister(phy->led_link_trigger); out_free_link:
@@ -141,10 +142,12 @@ void phy_led_triggers_unregister(struct phy_device *phy) { int i; - for (i = 0; i < phy->phy_num_led_triggers; i++) - phy_led_trigger_unregister(&phy->phy_led_triggers[i]); - kfree(phy->phy_led_triggers); - phy->phy_led_triggers = NULL; + if (phy->phy_led_triggers) { + for (i = 0; i < phy->phy_num_led_triggers; i++) + phy_led_trigger_unregister(&phy->phy_led_triggers[i]); + kfree(phy->phy_led_triggers); + phy->phy_led_triggers = NULL; + } if (phy->led_link_trigger) { phy_led_trigger_unregister(phy->led_link_trigger);
--
2.43.0