github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: phy: avoid double-free after LED trigger registration failure

Browse Source 
phy_led_triggers_register() frees phy_led_triggers when a speed trigger
registration fails, but leaves the pointer set to the freed allocation
before clearing phy_num_led_triggers.

phy_probe() ignores the registration error. If a later probe step fails,
its error path calls phy_led_triggers_unregister(); normal teardown during
an unbind or MDIO bus removal calls the same helper from phy_remove().
In either case, the trigger count is zero, so the per-trigger unregister
loop is skipped, but the dangling pointer is still freed unconditionally.

Clear the pointer when partial registration cleanup frees the array, and
make phy_led_triggers_unregister() free the array only when its pointer is
non-NULL.

Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Link: https://patch.msgid.link/20260823035600.188864-7-xuanqiang.luo@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Xuanqiang Luo 2026-08-23 11:56:00 +08:00 committed by Jakub Kicinski
parent 48378efebb
commit f7f619ecda
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/net/phy/phy_led_triggers.c
View File

@ -126,6 +126,7 @@ int phy_led_triggers_register(struct phy_device *phy)
while (i--)
phy_led_trigger_unregister(&phy->phy_led_triggers[i]);
kfree(phy->phy_led_triggers);
phy->phy_led_triggers = NULL;
out_unreg_link:
phy_led_trigger_unregister(phy->led_link_trigger);
out_free_link:
@ -141,10 +142,12 @@ void phy_led_triggers_unregister(struct phy_device *phy)
{
int i;
for (i = 0; i < phy->phy_num_led_triggers; i++)
phy_led_trigger_unregister(&phy->phy_led_triggers[i]);
kfree(phy->phy_led_triggers);
phy->phy_led_triggers = NULL;
if (phy->phy_led_triggers) {
for (i = 0; i < phy->phy_num_led_triggers; i++)
phy_led_trigger_unregister(&phy->phy_led_triggers[i]);
kfree(phy->phy_led_triggers);
phy->phy_led_triggers = NULL;
}
if (phy->led_link_trigger) {
phy_led_trigger_unregister(phy->led_link_trigger);