CVE-2026-72391: net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy

In the Linux kernel, the following vulnerability has been resolved:

net: phy: sfp: free miibus in sfpi2cmdiobusdestroy

sfpi2cmdiobuscreate() allocates the I2C MDIO bus with mdioi2calloc(), a plain (non-devm) allocation, and registers it. sfpi2cmdiobusdestroy() only unregisters the bus and clears sfp->i2cmii without calling mdiobusfree(). As the only reference to the bus is then cleared, the struct miibus is leaked.

This is hit whenever a copper/RollBall SFP module that instantiated an MDIO bus is removed: sfpsmmain() takes the global teardown path and calls sfpi2cmdiobusdestroy(). sfpcleanup(), on driver unbind, frees sfp->i2cmii directly, which is why the leak only triggered on module hot-removal and not on unbind.

Free the bus in sfpi2cmdiobusdestroy() to match the allocation done in sfpi2cmdiobuscreate().