Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

phy: Fix phy_device_free memory leak

Fix memory leak in phy_device_free() for the case when phy_device*
returned by phy_device_create() is not registered in the system.

Bug description:
phy_device_create() sets name of kobject using dev_set_name(), which
allocates memory using kvasprintf(), but this memory isn't freed if
the underlying device isn't registered properly, because kobject_cleanup()
is not called in that case. This can happen (and actually is happening on
our machines) if phy_device_register(), called by mdiobus_scan(), fails.

Patch description:
Embedded struct device is initialized in phy_device_create() and it
counterpart phy_device_free() just drops one reference to the device,
which leads to proper deinitialization including releasing the kobject
name memory.

Signed-off-by: Petr Malat <oss@malat.biz>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Petr Malat and committed by
David S. Miller
b2a43191 d521de04

+6 -4
+6 -4
drivers/net/phy/phy_device.c
··· 44 44 45 45 void phy_device_free(struct phy_device *phydev) 46 46 { 47 - kfree(phydev); 47 + put_device(&phydev->dev); 48 48 } 49 49 EXPORT_SYMBOL(phy_device_free); 50 50 51 51 static void phy_device_release(struct device *dev) 52 52 { 53 - phy_device_free(to_phy_device(dev)); 53 + kfree(to_phy_device(dev)); 54 54 } 55 55 56 56 static struct phy_driver genphy_driver; ··· 200 200 driver will get bored and give up as soon as it finds that 201 201 there's no driver _already_ loaded. */ 202 202 request_module(MDIO_MODULE_PREFIX MDIO_ID_FMT, MDIO_ID_ARGS(phy_id)); 203 + 204 + device_initialize(&dev->dev); 203 205 204 206 return dev; 205 207 } ··· 365 363 /* Run all of the fixups for this PHY */ 366 364 phy_scan_fixups(phydev); 367 365 368 - err = device_register(&phydev->dev); 366 + err = device_add(&phydev->dev); 369 367 if (err) { 370 - pr_err("phy %d failed to register\n", phydev->addr); 368 + pr_err("PHY %d failed to add\n", phydev->addr); 371 369 goto out; 372 370 } 373 371