From 220bb3c31c3b8060d60bca4bba55095662efd13f Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Thu, 2 Jul 2026 15:21:12 +0000 Subject: [PATCH] wifi: mt76: mt7915: unregister thermal cooling device on hwmon failure mt7915_thermal_init() registered the thermal cooling device and its sysfs link, then returned the hwmon registration error without undoing them. The cooling device (not devm-managed) and the link then leaked, and its callbacks referenced the freed phy. Unregister the cooling device before returning the error. Fixes: 0ae3ff568451 ("mt76: mt7915: fix hwmon temp sensor mem use-after-free") Signed-off-by: Felix Fietkau --- mt7915/init.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/mt7915/init.c b/mt7915/init.c index da402d45..0505e6d3 100644 --- a/mt7915/init.c +++ b/mt7915/init.c @@ -248,7 +248,12 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, phy, mt7915_hwmon_groups); - return PTR_ERR_OR_ZERO(hwmon); + if (IS_ERR(hwmon)) { + mt7915_unregister_thermal(phy); + return PTR_ERR(hwmon); + } + + return 0; } static void mt7915_led_set_config(struct led_classdev *led_cdev,