[PATCH v6 1/5] leds: trigger: netdev: Put netdev on activate error path
From: A. Sverdlin
Date: Tue Oct 27 2026 - 07:36:06 EST
From: Alexander Sverdlin <alexander.sverdlin@xxxxxxxxxxx>
When hw control is active, set_device_name() takes a reference on the
netdev via dev_get_by_name(). The register_netdevice_notifier() failure
path frees trigger_data without dropping it, leaking the netdev.
Cc: stable@xxxxxxxxxxxxxxx
Closes: https://lore.kernel.org/all/20260914140045.B8F4C1F000FF@xxxxxxxxxxxxxxx/
Fixes: 0316cc5629d1 ("leds: trigger: netdev: init mode if hw control already active")
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@xxxxxxxxxxx>
---
Changelog:
v5:
- removed unset_device_name()
v3:
- introduced unset_device_name() as a counterpart of set_device_name()
drivers/leds/trigger/ledtrig-netdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c
index 5b0132484594c..cfaf130157b3d 100644
--- a/drivers/leds/trigger/ledtrig-netdev.c
+++ b/drivers/leds/trigger/ledtrig-netdev.c
@@ -776,8 +776,10 @@ static int netdev_trig_activate(struct led_classdev *led_cdev)
led_set_trigger_data(led_cdev, trigger_data);
rc = register_netdevice_notifier(&trigger_data->notifier);
- if (rc)
+ if (rc) {
+ dev_put(trigger_data->net_dev);
kfree(trigger_data);
+ }
return rc;
}
--
2.56.0