[PATCH net-next v2 1/2] net: pse-pd: si3474: fix use-after-free in ancillary client error path
From: Carlo Szelinsky
Date: Tue Oct 20 2026 - 13:22:11 EST
If devm_add_action_or_reset() fails, it has already unregistered the
ancillary I2C client, and the error message then reads that client's
device. It can only fail with -ENOMEM, which is already reported, so
drop the message.
Found by code inspection. Not reproduced.
Fixes: a2317231df4b ("net: pse-pd: Add Si3474 PSE controller driver")
Reviewed-by: Kory Maincent <kory.maincent@xxxxxxxxxxx>
Signed-off-by: Carlo Szelinsky <github@xxxxxxxxxxxx>
---
drivers/net/pse-pd/si3474.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/net/pse-pd/si3474.c b/drivers/net/pse-pd/si3474.c
index 1845b9c51cf7..2f4f241a48af 100644
--- a/drivers/net/pse-pd/si3474.c
+++ b/drivers/net/pse-pd/si3474.c
@@ -516,10 +516,8 @@ static int si3474_i2c_probe(struct i2c_client *client)
return PTR_ERR(priv->client[1]);
ret = devm_add_action_or_reset(dev, si3474_ancillary_i2c_remove, priv->client[1]);
- if (ret < 0) {
- dev_err(&priv->client[1]->dev, "Cannot register remove callback\n");
+ if (ret)
return ret;
- }
ret = i2c_smbus_read_byte_data(priv->client[1], VENDOR_IC_ID_REG);
if (ret < 0) {
--
2.43.0