In case of error in build_tokens_sysfs(), all the memory that has been
allocated is freed at end of this function. But then free_group() is
called which performs memory deallocation again.

Fix this issue by replacing free_group() call with exit_dell_smbios_wmi()
and exit_dell_smbios_smm().

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 33b9ca1e53b4 ("platform/x86: dell-smbios: Add a sysfs interface for SMBIOS tokens")
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
---
 drivers/platform/x86/dell/dell-smbios-base.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/dell/dell-smbios-base.c b/drivers/platform/x86/dell/dell-smbios-base.c
index 6565fac24cde..73e41eb69cb5 100644
--- a/drivers/platform/x86/dell/dell-smbios-base.c
+++ b/drivers/platform/x86/dell/dell-smbios-base.c
@@ -622,7 +622,10 @@ static int __init dell_smbios_init(void)
 	return 0;
 
 fail_sysfs:
-	free_group(platform_device);
+	if (!wmi)
+		exit_dell_smbios_wmi();
+	if (!smm)
+		exit_dell_smbios_smm();
 
 fail_create_group:
 	platform_device_del(platform_device);
-- 
2.30.2

On Wed, 28 Aug 2024, Aleksandr Mishin wrote:

> In case of error in build_tokens_sysfs(), all the memory that has been
> allocated is freed at end of this function. But then free_group() is
> called which performs memory deallocation again.
> 
> Fix this issue by replacing free_group() call with exit_dell_smbios_wmi()

There are two issues and only one is properly described. Please amend the 
commit message to cover the other problem too.

-- 
 i.

> and exit_dell_smbios_smm().
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 33b9ca1e53b4 ("platform/x86: dell-smbios: Add a sysfs interface for SMBIOS tokens")
> Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
> ---
>  drivers/platform/x86/dell/dell-smbios-base.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/x86/dell/dell-smbios-base.c b/drivers/platform/x86/dell/dell-smbios-base.c
> index 6565fac24cde..73e41eb69cb5 100644
> --- a/drivers/platform/x86/dell/dell-smbios-base.c
> +++ b/drivers/platform/x86/dell/dell-smbios-base.c
> @@ -622,7 +622,10 @@ static int __init dell_smbios_init(void)
>  	return 0;
>  
>  fail_sysfs:
> -	free_group(platform_device);
> +	if (!wmi)
> +		exit_dell_smbios_wmi();
> +	if (!smm)
> +		exit_dell_smbios_smm();
>  
>  fail_create_group:
>  	platform_device_del(platform_device);
>

In case of error in build_tokens_sysfs(), all the memory that has been
allocated is freed at end of this function. But then free_group() is
called which performs memory deallocation again.

Also, instead of free_group() call, there should be exit_dell_smbios_smm()
and exit_dell_smbios_wmi() calls, since there is initialization, but there
is no release of resources in case of an error.

Fix this issue by replacing free_group() call with exit_dell_smbios_wmi()
and exit_dell_smbios_smm().

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 33b9ca1e53b4 ("platform/x86: dell-smbios: Add a sysfs interface for SMBIOS tokens")
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
---
v2: Update comment message for a more detailed description of issues

 drivers/platform/x86/dell/dell-smbios-base.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/dell/dell-smbios-base.c b/drivers/platform/x86/dell/dell-smbios-base.c
index 6565fac24cde..73e41eb69cb5 100644
--- a/drivers/platform/x86/dell/dell-smbios-base.c
+++ b/drivers/platform/x86/dell/dell-smbios-base.c
@@ -622,7 +622,10 @@ static int __init dell_smbios_init(void)
 	return 0;
 
 fail_sysfs:
-	free_group(platform_device);
+	if (!wmi)
+		exit_dell_smbios_wmi();
+	if (!smm)
+		exit_dell_smbios_smm();
 
 fail_create_group:
 	platform_device_del(platform_device);
-- 
2.30.2

On Fri, 30 Aug 2024 09:54:28 +0300, Aleksandr Mishin wrote:

> In case of error in build_tokens_sysfs(), all the memory that has been
> allocated is freed at end of this function. But then free_group() is
> called which performs memory deallocation again.
> 
> Also, instead of free_group() call, there should be exit_dell_smbios_smm()
> and exit_dell_smbios_wmi() calls, since there is initialization, but there
> is no release of resources in case of an error.
> 
> [...]


Thank you for your contribution, it has been applied to my local
review-ilpo branch. Note it will show up in the public
platform-drivers-x86/review-ilpo branch only once I've pushed my
local branch there, which might take a while.

The list of commits applied:
[1/1] platform/x86: dell-smbios: Fix error path in dell_smbios_init()
      commit: ffc17e1479e8e9459b7afa80e5d9d40d0dd78abb

--
 i.