From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D61D51AFF6 for ; Tue, 29 Sep 2026 12:09:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.136.64.225 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790683751; cv=none; b=OGNgiDiL2rF7xUYin2tSftGhG/S3RFEhLajFb2ju7WRWht8uWEaS0AP1EHALXXmRjUXLPrB/q74Ea3dKoBFH1+4otnN5qx0j2cjkJ4yXULeYwWMUdnQX1CnuHQWiun6SFkOjGnuVsKeUeVnmmEVeJpSkeg2Zp6EjA70SC7TtQ1Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790683751; c=relaxed/simple; bh=5eQizxKK9NuYLh8sm1blsIP6nlT5QAXKPTApBxVkzCg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZqkXkyqxoIWGgn8Oq1qdpD16u4nesHt8Ds4eq1XAuaUbCj2XriUTKt3Pnnvugqk4PsNvxDA8p6SrfKEnBXCa11sgFlT/5x76cu7Iu33cFaXYgn5pXzSFWE51uprJfo5D/nWurple1Xqw5BAiPCApAzV8EUwephkxG7MBf87NIBg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b=EaAR2F0D; arc=none smtp.client-ip=185.136.64.225 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=siemens.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rts-flowmailer.siemens.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=siemens.com header.i=alexander.sverdlin@siemens.com header.b="EaAR2F0D" Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 202609291209051c00be832f000207bb for ; Tue, 29 Sep 2026 14:09:06 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=alexander.sverdlin@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=D6Ufe1MknHNgW3U5Ph4TDlWqQIvp7PRTpmjTSC8ykEA=; b=EaAR2F0DfdcA5u4bHBYu2C3ZBGoT4UXD8xvofpgd+CuP7jGgouF7k0O+Vgncn+n38/D2md GMVPMAH8LrcIZGcQGxg8ziCKhbQYqrdkc3uLeInKY+J2Z73AD6qsgTybFytDywL+Lu08voUZ vA1AKMKtIG7phNjxdkTa2PPeFeXFjzzjAuxn7VF5gs3QJLhPvJrnp15AZHbX3/NeE/S9ESec WlqU6e40i+Gd3p3RYbbMPLr1bppBV928dIz6HAWet73MdLzwNfmsRxS5S4+GpZgfoZ/zeddO LQAcBderdtN6tTvPmdikRU0HnpdCDMbGbwXTygr1obyGRDjWrcVO+bYw==; From: "A. Sverdlin" To: linux-leds@vger.kernel.org Cc: Alexander Sverdlin , Lee Jones , Pavel Machek , Andrew Lunn , "Mike Marciniszyn (Meta)" , Jakub Kicinski , Kees Cook , =?UTF-8?q?Marek=20Beh=C3=BAn?= , Christian Marangi , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v3 1/4] leds: trigger: netdev: Put netdev on activate error path Date: Tue, 29 Sep 2026 14:08:51 +0200 Message-ID: <20260929120902.2793138-2-alexander.sverdlin@siemens.com> In-Reply-To: <20260929120902.2793138-1-alexander.sverdlin@siemens.com> References: <20260929120902.2793138-1-alexander.sverdlin@siemens.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-456497:519-21489:flowmailer From: Alexander Sverdlin When hw control is active, set_device_name() takes a reference on the netdev via dev_get_by_name(). The register_netdevice_notifier() failure path frees trigger_data without dropping it, leaking the netdev. Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/20260914140045.B8F4C1F000FF@smtp.kernel.org/ Fixes: 0316cc5629d1 ("leds: trigger: netdev: init mode if hw control already active") Signed-off-by: Alexander Sverdlin --- Changelog: v3: - introduced unset_device_name() as a counterpart of set_device_name() drivers/leds/trigger/ledtrig-netdev.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c index 5b0132484594c..e2a6c95a0dc97 100644 --- a/drivers/leds/trigger/ledtrig-netdev.c +++ b/drivers/leds/trigger/ledtrig-netdev.c @@ -324,6 +324,13 @@ static int set_device_name(struct led_netdev_data *trigger_data, return 0; } +static void unset_device_name(struct led_netdev_data *trigger_data) +{ + dev_put(trigger_data->net_dev); + trigger_data->net_dev = NULL; + trigger_data->device_name[0] = 0; +} + static ssize_t device_name_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t size) @@ -776,8 +783,10 @@ static int netdev_trig_activate(struct led_classdev *led_cdev) led_set_trigger_data(led_cdev, trigger_data); rc = register_netdevice_notifier(&trigger_data->notifier); - if (rc) + if (rc) { + unset_device_name(trigger_data); kfree(trigger_data); + } return rc; } @@ -790,7 +799,7 @@ static void netdev_trig_deactivate(struct led_classdev *led_cdev) cancel_delayed_work_sync(&trigger_data->work); - dev_put(trigger_data->net_dev); + unset_device_name(trigger_data); kfree(trigger_data); } -- 2.55.0