In drivers/net/ieee802154/mac802154_hwsim.c, clean up allocated edges
and phys on error paths and validate netlink attribute bounds.

Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
index a9bd1555d2dc..1b325d665177 100644
--- a/drivers/net/ieee802154/mac802154_hwsim.c
+++ b/drivers/net/ieee802154/mac802154_hwsim.c
@@ -987,6 +987,8 @@ static int hwsim_add_one(struct genl_info *info, struct device *dev,
 
 err_subscribe:
 	ieee802154_unregister_hw(phy->hw);
+	kfree_rcu(rcu_dereference_protected(phy->pib, 1), rcu);
+	goto err_pib;
 err_reg:
 	kfree(pib);
 err_pib:
@@ -1003,6 +1005,8 @@ static void hwsim_del(struct hwsim_phy *phy)
 
 	list_del(&phy->list);
 
+	ieee802154_unregister_hw(phy->hw);
+
 	rcu_read_lock();
 	list_for_each_entry_rcu(e, &phy->edges, list) {
 		list_del_rcu(&e->list);
@@ -1013,7 +1017,6 @@ static void hwsim_del(struct hwsim_phy *phy)
 
 	kfree_rcu(pib, rcu);
 
-	ieee802154_unregister_hw(phy->hw);
 	ieee802154_free_hw(phy->hw);
 }

On 19/09/2026 at 22:34:34 GMT, Hui Peng <benquike@gmail.com> wrote:

> In drivers/net/ieee802154/mac802154_hwsim.c, clean up allocated edges
> and phys on error paths and validate netlink attribute bounds.
>
> Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>