hwmon_sanitize_name() allocates sfp->hwmon_name before hwmon_device_register_with_info() is called. If the registration fails, sfp->hwmon_dev is left as an error pointer while sfp->hwmon_name remains allocated. Later, when the SFP module is removed, sfp_hwmon_remove() is still called. However, it frees sfp->hwmon_name only when !IS_ERR_OR_NULL(sfp->hwmon_dev) is true. Since sfp->hwmon_dev is an error pointer in the failure case, the cleanup block is skipped and hwmon_name is leaked. Fix this by cleaning up hwmon_name independently of hwmon_dev. Continue to unregister the hwmon device only when hwmon_dev is valid, but free hwmon_name whenever it is a valid allocated pointer. Fixes: 3f118c449c8e ("net: sfp: use hwmon_sanitize_name()") Suggested-by: Andrew Lunn Signed-off-by: Krishan Singh --- drivers/net/phy/sfp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c index f52020673..bfa2b821f 100644 --- a/drivers/net/phy/sfp.c +++ b/drivers/net/phy/sfp.c @@ -1916,7 +1916,11 @@ static void sfp_hwmon_remove(struct sfp *sfp) if (!IS_ERR_OR_NULL(sfp->hwmon_dev)) { hwmon_device_unregister(sfp->hwmon_dev); sfp->hwmon_dev = NULL; + } + + if (!IS_ERR_OR_NULL(sfp->hwmon_name)) { kfree(sfp->hwmon_name); + sfp->hwmon_name = NULL; } } -- 2.34.1