net: sfp: fix hwmon_name memory leak on hwmon registration failure

[PATCH net-next v2] net: sfp: fix hwmon_name memory leak on hwmon registration failure

Posted by Krishan Singh 1 month, 3 weeks ago

hwmon_sanitize_name() allocates sfp->hwmon_name before
hwmon_device_register_with_info() is called. If the registration
fails, sfp->hwmon_dev is left pointing to an error while
sfp->hwmon_name remains allocated.

Later, when the SFP module is removed, sfp_hwmon_remove() only frees
hwmon_name when hwmon_dev is valid. As a result, hwmon_name is leaked
if hwmon_device_register_with_info() fails.

Free hwmon_name independently of hwmon_dev. Continue to unregister the
hwmon device only when hwmon_dev was successfully registered.

Fixes: 3f118c449c8e ("net: sfp: use hwmon_sanitize_name()")
Suggested-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Krishan Singh <krishanmohan298@gmail.com>

---
v2:
- Move hwmon_name cleanup to sfp_hwmon_remove().
- Free hwmon_name independently of hwmon_dev.
---
 drivers/net/phy/sfp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index f52020673..bfa2b821f 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -1916,7 +1916,11 @@ static void sfp_hwmon_remove(struct sfp *sfp)
 	if (!IS_ERR_OR_NULL(sfp->hwmon_dev)) {
 		hwmon_device_unregister(sfp->hwmon_dev);
 		sfp->hwmon_dev = NULL;
+	}
+
+	if (!IS_ERR_OR_NULL(sfp->hwmon_name)) {
 		kfree(sfp->hwmon_name);
+		sfp->hwmon_name = NULL;
 	}
 }
 
-- 
2.34.1

Re: [PATCH net-next v2] net: sfp: fix hwmon_name memory leak on hwmon registration failure

Posted by Andrew Lunn 1 month, 2 weeks ago

On Sun, Aug 09, 2026 at 12:15:04PM +0530, Krishan Singh wrote:
> hwmon_sanitize_name() allocates sfp->hwmon_name before
> hwmon_device_register_with_info() is called. If the registration
> fails, sfp->hwmon_dev is left pointing to an error while
> sfp->hwmon_name remains allocated.
> 
> Later, when the SFP module is removed, sfp_hwmon_remove() only frees
> hwmon_name when hwmon_dev is valid. As a result, hwmon_name is leaked
> if hwmon_device_register_with_info() fails.
> 
> Free hwmon_name independently of hwmon_dev. Continue to unregister the
> hwmon device only when hwmon_dev was successfully registered.
> 
> Fixes: 3f118c449c8e ("net: sfp: use hwmon_sanitize_name()")
> Suggested-by: Andrew Lunn <andrew@lunn.ch>
> Signed-off-by: Krishan Singh <krishanmohan298@gmail.com>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew