hwmon_sanitize_name() allocates sfp->hwmon_name before hwmon_device_register_with_info() is called. If the registration fails, sfp->hwmon_dev is left pointing to an error while sfp->hwmon_name remains allocated. Later, when the SFP module is removed, sfp_hwmon_remove() only frees hwmon_name when hwmon_dev is valid. As a result, hwmon_name is leaked if hwmon_device_register_with_info() fails. Free hwmon_name independently of hwmon_dev. Continue to unregister the hwmon device only when hwmon_dev was successfully registered. Fixes: 3f118c449c8e ("net: sfp: use hwmon_sanitize_name()") Suggested-by: Andrew Lunn Signed-off-by: Krishan Singh --- v2: - Move hwmon_name cleanup to sfp_hwmon_remove(). - Free hwmon_name independently of hwmon_dev. --- drivers/net/phy/sfp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c index f52020673..bfa2b821f 100644 --- a/drivers/net/phy/sfp.c +++ b/drivers/net/phy/sfp.c @@ -1916,7 +1916,11 @@ static void sfp_hwmon_remove(struct sfp *sfp) if (!IS_ERR_OR_NULL(sfp->hwmon_dev)) { hwmon_device_unregister(sfp->hwmon_dev); sfp->hwmon_dev = NULL; + } + + if (!IS_ERR_OR_NULL(sfp->hwmon_name)) { kfree(sfp->hwmon_name); + sfp->hwmon_name = NULL; } } -- 2.34.1