Hi Dan,
...
>        switch (phy_type) {
>        case CFPHYTYPE_FRAG:
>                phy_driver =
>                    cfserl_create(CFPHYTYPE_FRAG, phyid, stx);
>                if (!phy_driver)
> -                       goto out;
> +                       goto out_err;
>                break;
...
> -out:
> +       mutex_unlock(&cnfg->lock);
> +       return;
> +
> +out_err:
> +       kfree(phyinfo);
>        mutex_unlock(&cnfg->lock);

Thank you for your patch.
When reviewing this I found another potential memory leak as well.
If cffrml_create fails, we might be leaking the phy_driver.
So perhaps you could do kfree(phy_driver) in out_err: as well, while
you are at it?

Regards,
Sjur