Re: [PATCH 2/3] leds: trigger: netdev: fix sysfs_update_group() vs led_trigger_set() races

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Memory leak of `net_device` reference on error paths in `netdev_trig_activate()`.
--

commit 8000797f0bcd86f582cb708cea2c7a3ec07a48c4
Author: Alexander Sverdlin <alexander.sverdlin@siemens.com>

leds: trigger: netdev: fix sysfs_update_group() vs led_trigger_set() races

The netdev LED trigger is reworked to own the link_speed attribute group
lifecycle instead of letting the LED core manage it. This is achieved by
creating and removing the group in the activate and deactivate callbacks,
fixing sysfs race conditions during concurrent link-up events.

> diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c
> --- a/drivers/leds/trigger/ledtrig-netdev.c
> +++ b/drivers/leds/trigger/ledtrig-netdev.c

[ ... ]

> @@ -784,10 +795,29 @@ static int netdev_trig_activate(struct led_classdev *led_cdev)
>  
>  	led_set_trigger_data(led_cdev, trigger_data);
>  
> +	/*
> +	 * Own the link_speed attribute group here instead of listing it in
> +	 * netdev_led_trigger.groups, so its later sysfs_update_group() refreshes
> +	 * cannot race with the LED core's device_add_groups() /
> +	 * device_remove_groups().  Create it before registering the notifier so
> +	 * that a NETDEV_CHANGE cannot refresh a not-yet-created group.
> +	 */
> +	rc = sysfs_create_group(&led_cdev->dev->kobj,
> +				&netdev_trig_link_speed_attrs_group);
> +	if (rc)
> +		goto err_free;
> +
>  	rc = register_netdevice_notifier(&trigger_data->notifier);
>  	if (rc)
> -		kfree(trigger_data);
> +		goto err_remove_group;
>  
> +	return 0;
> +
> +err_remove_group:
> +	sysfs_remove_group(&led_cdev->dev->kobj,
> +			   &netdev_trig_link_speed_attrs_group);
> +err_free:
> +	kfree(trigger_data);
>  	return rc;
>  }

[Severity: High]
This is a pre-existing issue, but this patch adds a new, realistically
reachable failure point (sysfs_create_group) that triggers it.

Earlier in netdev_trig_activate(), if hw control is supported, the driver
calls set_device_name() which can acquire a network device reference via
dev_get_by_name() and store it in trigger_data->net_dev.

If sysfs_create_group() or register_netdevice_notifier() subsequently fail,
the code jumps to the err_free label. It frees trigger_data but misses
calling dev_put(trigger_data->net_dev) to release the acquired reference.

Could this missing dev_put() leak the reference and cause subsequent calls to
unregister_netdevice() to hang indefinitely while waiting for the network
device to become free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914132356.807004-1-alexander.sverdlin@siemens.com?part=2