net: phy: Fix use after free in phy_detach()
authorGeert Uytterhoeven <geert+renesas@glider.be>
Mon, 28 Nov 2016 14:18:31 +0000 (15:18 +0100)
committerDavid S. Miller <davem@davemloft.net>
Wed, 30 Nov 2016 01:35:24 +0000 (20:35 -0500)
commit0075bd692dca037108fd8b5d90a68d34bad4c2f8
treee944e0663f0535a97b35bfb0cb69bbe6ea89320e
parent22d3efe5f62e048eb2c85b9ef24e3b7af545a458
net: phy: Fix use after free in phy_detach()

If device_release_driver(&phydev->mdio.dev) is called, it releases all
resources belonging to the PHY device. Hence the subsequent call to
phy_led_triggers_unregister() will access already freed memory when
unregistering the LEDs.

Move the call to phy_led_triggers_unregister() before the possible call
to device_release_driver() to fix this.

Fixes: 2e0bc452f4721520 ("net: phy: leds: add support for led triggers on phy link state change")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Zach Brown <zach.brown@ni.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/phy/phy_device.c