The cs40l50_upload_owt() function allocates memory via kmalloc()
without checking for allocation failure, which could lead to a
NULL pointer dereference when GFP_KERNEL allocation fails under
memory pressure.

Additionally, if any subsequent operation fails after successful
allocation, the allocated memory is not freed, causing a memory
leak.

Therefore, add a NULL check for kmalloc() and returns -ENOMEM on
failure. And use a goto cleanup pattern to ensure the allocated
memory is freed on any error path.

Signed-off-by: Yunshui Jiang <jiangyunshui@kylinos.cn>
---
 drivers/input/misc/cs40l50-vibra.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/input/misc/cs40l50-vibra.c b/drivers/input/misc/cs40l50-vibra.c
index dce3b0ec8cf3..c48b6c905112 100644
--- a/drivers/input/misc/cs40l50-vibra.c
+++ b/drivers/input/misc/cs40l50-vibra.c
@@ -238,25 +238,31 @@ static int cs40l50_upload_owt(struct cs40l50_work *work_data)
 	header.data_words = len / sizeof(u32);
 
 	new_owt_effect_data = kmalloc(sizeof(header) + len, GFP_KERNEL);
+	if (!new_owt_effect_data)
+		return -ENOMEM;
 
 	memcpy(new_owt_effect_data, &header, sizeof(header));
 	memcpy(new_owt_effect_data + sizeof(header), work_data->custom_data, len);
 
 	error = regmap_read(vib->regmap, vib->dsp.owt_offset_reg, &offset);
 	if (error)
-		return error;
+		goto free_owt_data;
 
 	error = regmap_bulk_write(vib->regmap, vib->dsp.owt_base_reg +
 				  (offset * sizeof(u32)), new_owt_effect_data,
 				  sizeof(header) + len);
 	if (error)
-		return error;
+		goto free_owt_data;
 
 	error = vib->dsp.write(vib->dev, vib->regmap, vib->dsp.push_owt_cmd);
 	if (error)
-		return error;
+		goto free_owt_data;
 
 	return 0;
+
+free_owt_data:
+	kfree(new_owt_effect_data);
+	return error;
 }
 
 static void cs40l50_add_worker(struct work_struct *work)
-- 
2.47.1

Hi Yunshui,

On Fri, Jul 04, 2025 at 10:40:10AM +0800, Yunshui Jiang wrote:
> The cs40l50_upload_owt() function allocates memory via kmalloc()
> without checking for allocation failure, which could lead to a
> NULL pointer dereference when GFP_KERNEL allocation fails under
> memory pressure.

Yes, the check is indeed missing. It is likely that the allocation is
small enough so it always succeeds (or waits indefinitely), but it is a
good idea to add the check nevertheless.

> 
> Additionally, if any subsequent operation fails after successful
> allocation, the allocated memory is not freed, causing a memory
> leak.

This is not correct. Because the new_owt_effect_data variable is
annotated as __free(kfree) it will be automatically freed at the end of
the function scope. Your patch introduces a double-free.

I will adjust to only keep the check and apply, thank you.

Thanks.

-- 
Dmitry