> (gdb) print /x (int)&((struct phy_driver *)0)->led_brightness_set
> $1 = 0x1f0
>
> so this would indeed look like an use-after-free here. If you tested with a
> PHYLINK enabled driver you might have no seen due to
> phylink_disconnect_phy() being called with RTNL held?
Yes, i've been testing with mvneta, which is phylink.
Andrew
