Re: [PATCH] net: sfp: fix hwmon_name leak on hwmon registration failure

From: Janis Edvarts Lacis

Date: Sat Aug 01 2026 - 17:33:50 EST


I have looked into the code for sfp_hwmon_remove calls to the
best of my abilities and Andrew is right that sfp_hwmon_remove
is called on every sfp device.

If sfp_hwmon_probe fails in hwmon_device_register_with_info function call,
it leaves sfp->hwmon_dev as an error pointer. When sfp_check_state detects
that SFP_F_PRESENT has changed, it sends SFP_E_REMOVE which leads to sfp_hwmon_remove
call. In sfp_hwmon_remove sfp->hwmon_name is not freed because
!IS_ERR_OR_NULL(sfp->hwmon_dev) is false therefore the whole cleanup block is skipped.

So, as Andrew suggested, freeing sfp->hwmon_name if it is not NULL
and it is not an error pointer (hwmon_sanitize_name can return an error
pointer) instead of freeing only when sfp->hwmon_dev is valid seems
to be the correct approach.