From: Geert Uytterhoeven <geert+rene...@glider.be>
Date: Mon, 28 Nov 2016 15:18:31 +0100
> If device_release_driver(&phydev->mdio.dev) is called, it releases all
> resources belonging to the PHY device. Hence the subsequent call to
> phy_led_triggers_unregister() will access already freed memory when
> unregistering the LEDs.
>
> Move the call to phy_led_triggers_unregister() before the possible call
> to device_release_driver() to fix this.
>
> Fixes: 2e0bc452f4721520 ("net: phy: leds: add support for led triggers on phy
> link state change")
> Signed-off-by: Geert Uytterhoeven <geert+rene...@glider.be>
> ---
> This is v2 of "[RFC] net: phy: Fix double free in phy_detach()".
>
> v2:
> - Dropped RFC,
> - Reworded, as commit a7dac9f9c1695d74 ("phy: fix error case of
> phy_led_triggers_(un)register") fixed the double free, and thus the
> warning I was seeing during "poweroff" on sh73a0/kzm9g,
> - Verified use after free using CONFIG_DEBUG_DEVRES, log_devres = 1,
> and additional debug code printing the address of
> phy->phy_led_triggers. Adding poisoning of freed memory to
> devres_log() will cause a crash.
Applied, thanks.
