Re: [PATCH net v5 6/6] net: phy: avoid double-free after LED trigger registration failure

[Paolo Abeni]

On 8/23/26 5:56 AM, Xuanqiang Luo wrote:
> From: Xuanqiang Luo <luoxuanqiang@xxxxxxxxxx>
> 
> phy_led_triggers_register() frees phy_led_triggers when a speed trigger
> registration fails, but leaves the pointer set to the freed allocation
> before clearing phy_num_led_triggers.
> 
> phy_probe() ignores the registration error. If a later probe step fails,
> its error path calls phy_led_triggers_unregister(); normal teardown during
> an unbind or MDIO bus removal calls the same helper from phy_remove().
> In either case, the trigger count is zero, so the per-trigger unregister
> loop is skipped, but the dangling pointer is still freed unconditionally.
> 
> Clear the pointer when partial registration cleanup frees the array, and
> make phy_led_triggers_unregister() free the array only when its pointer is
> non-NULL.
> 
> Fixes: b7f0ee992adf ("net: phy: leds: fix memory leak")
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@xxxxxxxxxx>
I think an explicit ack from phy experts is needed here: sashiko has
flagged a few pre-existing issues on this patch:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260823035600.188864-1-xuanqiang.luo%40linux.dev

that IMHO bortderline to be addresses in this same series.

/P