net: ethernet: adi: adin1110: Fix phy_device leak in probe_netdevs()

adin1110_probe_netdevs() probes each port with get_phy_device(), which
allocates a phy_device without registering it. The pointer's only use
is phydev_name() for the phy_connect() call, and phy_connect() attaches
the device the earlier bus scan registered, not the one allocated here.
port_priv->phydev is then overwritten with the phy_connect() result and
the allocated object is lost.

The devm cleanup action only disconnects the PHY that phy_connect()
attached, so nothing frees the lost object: one struct phy_device per
port leaks on every probe.

Keep the get_phy_device() result in a local variable and free it with
phy_device_free() after phy_connect() returns, success or not, as
mdiobus_scan() already does when phy_device_register() fails.

Found during a code review of the MDIO attach paths. get_phy_device()
only calls phy_device_create(), and phy_connect() can only return a
registered device.

Signed-off-by: Xia Yan <redacted>
---
 drivers/net/ethernet/adi/adin1110.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/adi/adin1110.c b/drivers/net/ethernet/adi/adin1110.c
index 53fac3d..fd769f1 100644
--- a/drivers/net/ethernet/adi/adin1110.c
+++ b/drivers/net/ethernet/adi/adin1110.c

@@ -1571,6 +1571,7 @@ static int adin1110_probe_netdevs(struct adin1110_priv *priv)
 	struct device *dev = &priv->spidev->dev;
 	struct adin1110_port_priv *port_priv;
 	struct net_device *netdev;
+	struct phy_device *phydev;
 	int ret;
 	int i;
 

@@ -1604,16 +1605,17 @@ static int adin1110_probe_netdevs(struct adin1110_priv *priv)
 		netdev->priv_flags |= IFF_UNICAST_FLT;
 		netdev->netns_immutable = true;
 
-		port_priv->phydev = get_phy_device(priv->mii_bus, i + 1, false);
-		if (IS_ERR(port_priv->phydev)) {
+		phydev = get_phy_device(priv->mii_bus, i + 1, false);
+		if (IS_ERR(phydev)) {
 			netdev_err(netdev, "Could not find PHY with device address: %d.\n", i);
-			return PTR_ERR(port_priv->phydev);
+			return PTR_ERR(phydev);
 		}
 
 		port_priv->phydev = phy_connect(netdev,
-						phydev_name(port_priv->phydev),
+						phydev_name(phydev),
 						adin1110_adjust_link,
 						PHY_INTERFACE_MODE_INTERNAL);
+		phy_device_free(phydev);
 		if (IS_ERR(port_priv->phydev)) {
 			netdev_err(netdev, "Could not connect PHY with device address: %d.\n", i);
 			return PTR_ERR(port_priv->phydev);

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

On 11/6/26 15:27, netdev-bot+sinfo wrote:

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Hi,

The leak was not hit at runtime. I found it by code inspection while
reviewing the MDIO attach paths, as the commit message notes. There is
no stack trace: the effect would be one struct phy_device allocated
per port on every probe and never released.

I don't have ADIN1100 or ADIN2111 hardware, so the change is
compile-tested only, with CONFIG_ADIN1110 enabled on x86_64.

Thanks,
Xia Yan

Hello:

This patch was applied to netdev/net-next.git (main)
by Paolo Abeni [off-list ref]:

On Fri, 06 Nov 2026 15:23:03 +0800 you wrote:

adin1110_probe_netdevs() probes each port with get_phy_device(), which
allocates a phy_device without registering it. The pointer's only use
is phydev_name() for the phy_connect() call, and phy_connect() attaches
the device the earlier bus scan registered, not the one allocated here.
port_priv->phydev is then overwritten with the phy_connect() result and
the allocated object is lost.

[...]

Here is the summary with links:
  - [net-next] net: ethernet: adi: adin1110: Fix phy_device leak in probe_netdevs()
    https://git.kernel.org/netdev/net-next/c/acdf2d09fa18

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html