The function thermal_genl_auto() does not free the allocated message
in the error path. Fix that by putting a out label and jump to it
which will free the message instead of directly returning an error.

Reported-by: Lukasz Luba <lukasz.luba@arm.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
---
  Changelog:
    - V2:
      - Return when the allocation fails instead of going to the out
        label resulting in a NULL pointer passed to nlmsg_free()
---
 tools/lib/thermal/commands.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/tools/lib/thermal/commands.c b/tools/lib/thermal/commands.c
index bcf0f14d035a..4998cec793ed 100644
--- a/tools/lib/thermal/commands.c
+++ b/tools/lib/thermal/commands.c
@@ -375,6 +375,7 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm
 					 struct cmd_param *param,
 					 int cmd, int flags, void *arg)
 {
+	thermal_error_t ret = THERMAL_ERROR;
 	struct nl_msg *msg;
 	void *hdr;
 
@@ -385,17 +386,19 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm
 	hdr = genlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, thermal_cmd_ops.o_id,
 			  0, flags, cmd, THERMAL_GENL_VERSION);
 	if (!hdr)
-		return THERMAL_ERROR;
+		goto out;
 
 	if (cmd_cb && cmd_cb(msg, param))
-		return THERMAL_ERROR;
+		goto out;
 
 	if (nl_send_msg(th->sk_cmd, th->cb_cmd, msg, genl_handle_msg, arg))
-		return THERMAL_ERROR;
+		goto out;
 
+	ret = THERMAL_SUCCESS;
+out:
 	nlmsg_free(msg);
 
-	return THERMAL_SUCCESS;
+	return ret;
 }
 
 thermal_error_t thermal_cmd_get_tz(struct thermal_handler *th, struct thermal_zone **tz)
-- 
2.43.0

On Thu, Oct 24, 2024 at 4:26 PM Daniel Lezcano
<daniel.lezcano@linaro.org> wrote:
>
> The function thermal_genl_auto() does not free the allocated message
> in the error path. Fix that by putting a out label and jump to it
> which will free the message instead of directly returning an error.
>
> Reported-by: Lukasz Luba <lukasz.luba@arm.com>
> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
> ---
>   Changelog:
>     - V2:
>       - Return when the allocation fails instead of going to the out
>         label resulting in a NULL pointer passed to nlmsg_free()
> ---
>  tools/lib/thermal/commands.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/tools/lib/thermal/commands.c b/tools/lib/thermal/commands.c
> index bcf0f14d035a..4998cec793ed 100644
> --- a/tools/lib/thermal/commands.c
> +++ b/tools/lib/thermal/commands.c
> @@ -375,6 +375,7 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm
>                                          struct cmd_param *param,
>                                          int cmd, int flags, void *arg)
>  {
> +       thermal_error_t ret = THERMAL_ERROR;
>         struct nl_msg *msg;
>         void *hdr;
>
> @@ -385,17 +386,19 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm
>         hdr = genlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, thermal_cmd_ops.o_id,
>                           0, flags, cmd, THERMAL_GENL_VERSION);
>         if (!hdr)
> -               return THERMAL_ERROR;
> +               goto out;
>
>         if (cmd_cb && cmd_cb(msg, param))
> -               return THERMAL_ERROR;
> +               goto out;
>
>         if (nl_send_msg(th->sk_cmd, th->cb_cmd, msg, genl_handle_msg, arg))
> -               return THERMAL_ERROR;
> +               goto out;
>
> +       ret = THERMAL_SUCCESS;
> +out:
>         nlmsg_free(msg);
>
> -       return THERMAL_SUCCESS;
> +       return ret;
>  }
>
>  thermal_error_t thermal_cmd_get_tz(struct thermal_handler *th, struct thermal_zone **tz)
> --

Applied, thanks!