[PATCH] fix: net: phy: phy_sfp_probe: fix kref leak when phy_setup_sfp_port fails after sfp_bus_add_upstream

[WenTao Liang]

sfp_bus_add_upstream unconditionally acquires a kref on the SFP bus. When
  this call succeeds but the subsequent phy_setup_sfp_port fails, the error
  path returns without releasing the upstream reference. Since probe fails,
  the device's remove function (which would normally clean this up) will
  never be called, permanently leaking the kref.

Call sfp_bus_del_upstream on the error path after a successful
  sfp_bus_add_upstream to properly release the upstream reference.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 298e54fa810e ("net: phy: add core phylib sfp support")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 drivers/net/phy/phy_device.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 3370eb822017..cd62c46de017 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1723,6 +1723,11 @@ static int phy_sfp_probe(struct phy_device *phydev)
 	if (!ret && phydev->sfp_bus)
 		ret = phy_setup_sfp_port(phydev);
 
+	if (ret && phydev->sfp_bus) {
+		sfp_bus_del_upstream(phydev->sfp_bus);
+		phydev->sfp_bus = NULL;
+	}
+
 	return ret;
 }
 
-- 
2.39.5 (Apple Git-154)