From 20232e99e8bfa44a6d77e8c3e0da2358f617e653 Mon Sep 17 00:00:00 2001 From: Krishan Singh Date: Sun, 9 Aug 2026 12:15:04 +0530 Subject: [PATCH] net: sfp: fix hwmon_name memory leak on hwmon registration failure hwmon_sanitize_name() allocates sfp->hwmon_name before hwmon_device_register_with_info() is called. If the registration fails, sfp->hwmon_dev is left pointing to an error while sfp->hwmon_name remains allocated. Later, when the SFP module is removed, sfp_hwmon_remove() only frees hwmon_name when hwmon_dev is valid. As a result, hwmon_name is leaked if hwmon_device_register_with_info() fails. Free hwmon_name independently of hwmon_dev. Continue to unregister the hwmon device only when hwmon_dev was successfully registered. Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path Suggested-by: Andrew Lunn Signed-off-by: Krishan Singh Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260809064504.70579-1-krishanmohan298@gmail.com Signed-off-by: Jakub Kicinski --- drivers/net/phy/sfp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c index 6c25b73c668a..508b6cc8eddc 100644 --- a/drivers/net/phy/sfp.c +++ b/drivers/net/phy/sfp.c @@ -1919,7 +1919,11 @@ static void sfp_hwmon_remove(struct sfp *sfp) if (!IS_ERR_OR_NULL(sfp->hwmon_dev)) { hwmon_device_unregister(sfp->hwmon_dev); sfp->hwmon_dev = NULL; + } + + if (!IS_ERR_OR_NULL(sfp->hwmon_name)) { kfree(sfp->hwmon_name); + sfp->hwmon_name = NULL; } }