[PATCH] net: sfp: Fix memory leak of hwmon_name on hwmon registration failure

    hwmon_sanitize_name() allocates sfp->hwmon_name before
    hwmon_device_register_with_info() is called. If the registration
    fails, sfp->hwmon_dev is left as an error pointer while
    sfp->hwmon_name remains allocated.

    Later, when the SFP module is removed, sfp_hwmon_remove() is still
    called. However, it frees sfp->hwmon_name only when
    !IS_ERR_OR_NULL(sfp->hwmon_dev) is true. Since sfp->hwmon_dev is an
    error pointer in the failure case, the cleanup block is skipped and
    hwmon_name is leaked.

    Fix this by cleaning up hwmon_name independently of hwmon_dev.
    Continue to unregister the hwmon device only when hwmon_dev is valid,
    but free hwmon_name whenever it is a valid allocated pointer.

    Fixes: 3f118c449c8e ("net: sfp: use hwmon_sanitize_name()")
    Suggested-by: Andrew Lunn <[email protected]>
    Signed-off-by: Krishan Singh <[email protected]>
---
 drivers/net/phy/sfp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index f52020673..bfa2b821f 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -1916,7 +1916,11 @@ static void sfp_hwmon_remove(struct sfp *sfp)
 	if (!IS_ERR_OR_NULL(sfp->hwmon_dev)) {
 		hwmon_device_unregister(sfp->hwmon_dev);
 		sfp->hwmon_dev = NULL;
+	}
+
+	if (!IS_ERR_OR_NULL(sfp->hwmon_name)) {
 		kfree(sfp->hwmon_name);
+		sfp->hwmon_name = NULL;
 	}
 }
 
-- 
2.34.1