Re: [PATCH net v5 6/6] net: phy: avoid double-free after LED trigger registration failure

On 8/23/26 5:56 AM, Xuanqiang Luo wrote:

From: Xuanqiang Luo <redacted>

phy_led_triggers_register() frees phy_led_triggers when a speed trigger
registration fails, but leaves the pointer set to the freed allocation
before clearing phy_num_led_triggers.

phy_probe() ignores the registration error. If a later probe step fails,
its error path calls phy_led_triggers_unregister(); normal teardown during
an unbind or MDIO bus removal calls the same helper from phy_remove().
In either case, the trigger count is zero, so the per-trigger unregister
loop is skipped, but the dangling pointer is still freed unconditionally.

Clear the pointer when partial registration cleanup frees the array, and
make phy_led_triggers_unregister() free the array only when its pointer is
non-NULL.

Fixes: b7f0ee992adf ("net: phy: leds: fix memory leak")
Signed-off-by: Xuanqiang Luo <redacted>

I think an explicit ack from phy experts is needed here: sashiko has
flagged a few pre-existing issues on this patch:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260823035600.188864-1-xuanqiang.luo%40linux.dev

that IMHO bortderline to be addresses in this same series.

/P