From nobody Wed Jun 17 04:06:28 2026 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8FF37346A1F for ; Tue, 28 Apr 2026 08:22:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777364539; cv=none; b=suP1CJ2Kf0mO0ppieW8cY2YQJKT31yOUbbg1RSNW3V3lJEl83T/7lVpHDap6aPV2HhGs+k3SP0VP/do7/dvMVD5/FINDGYd/cuUMjpdUSb77LxaDiprb2h3xgT1ddXUGKZeH4BhMjIhrNxv8zI5MEdwSIVOhLfiszHmCDs5Nxlc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777364539; c=relaxed/simple; bh=k/xPuNkR/BIM30zNpAyI8wz6sFjBLq7tGwi2ZmqSds4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=U83kn2wNOoXm7GUYv0hVB9uFL8h4XGo7HLs2Pi0jQ2PKf49D1cqeV/Mg90xkRQIzb9jARhGlnPP9RwDYK5Fp+DN/N9vaF8t0XTmIWNi0Qzu0GmYtCRAqsj3KIOoge65Bpo9LyPSJrD+xGIC0p2prAmLXLlymRp1nLJUhl1UIFiI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RUO10Vj4; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RUO10Vj4" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-827270d50d4so10066833b3a.3 for ; Tue, 28 Apr 2026 01:22:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777364538; x=1777969338; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=VMU6unxhoyoC/YoKPR6+gEr9cN2ykfBZJQ5EWE+zSYU=; b=RUO10Vj4t1iGmwVIKWM4qfhBRXSiVZcDJBXYRee1lWptk3fk1Clg47pkVA/Zc1mBc+ Qw9al4udFFqDKmXVGnRbYCHZYlt+W9sJlCjiyHios0g/NfPshqIM2tLhaNNA8L8vOAAt ke87ubTdlNLSmae9ioPLCeFR494/lY0dgb6Q/Rl5jXOYRifs1f90dzn1mofqVTPFBAAL ZXacniqYG5P6gjdfPxRqgFnyBriLtLNxYgHYpPAhi8EpF8lN1OqWmgvYXvF832V5k7mi BZLKjNzSxyxPr9vAjElgHAxH7J5kodDktNM0ekbmYIxMuTh3QhB4d5U06sue74s/ChtT H0Bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777364538; x=1777969338; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=VMU6unxhoyoC/YoKPR6+gEr9cN2ykfBZJQ5EWE+zSYU=; b=EI9hy7ol8IybxOV5r+ZFwsSaFIFPYSVYYolusq9vVSPg4YewWWXtbjGcJM9Fsbn4Tt L+e0jWPnEpQiHS6sNKPVahTdzQ4e3E502gV7cui4NFf9GiyVR4kbifvRugR1wW3WWdyf 1dD+I/K98GbKxT1ZMcf++9JgCkWnWH9RYx0iSRFm9RMLzXpK8ZwdlWpg8CXWf+mqaHy2 wOnvZwUm+pNrepoLYHGWMXIbSeXEnmEXpcUHwYWt3EkTLgVGNYh5+qgntWnsDO11DEvF pDjI8nOGLE/qGhGygMAWeqJ84YZxpWlvvELpC3LXTmXlvmbnSuqIjtlMwfMoTUsD8I4Z Rv4w== X-Forwarded-Encrypted: i=1; AFNElJ/KrCcKIJgFtNstLe25AsxAvAw+xjVVKpLteSVgGnZvnYF9z9jEgJkI9FBSKxyinNEy2y+2E8sE22sUMZg=@vger.kernel.org X-Gm-Message-State: AOJu0Yxko72OPpJ8OxBmSOgcFuZ9cwM33PK5C5/nExedQGMR9mFDWJaa xcgPq+n7usQnVWd1MXPcToaHNbM1EsHZcfEQnsKQK7sjiTy01id6+cWZ X-Gm-Gg: AeBDievvpd3z2nSUVzo9/hkxELUKArRcqxPRtE/PtSwZ0cSGXPazlhdSDfJsoshopbN KKTKtNXNSAf5bO2aXD/4CtZjSH0IuOdq99XzbHknRt7IvecSCYvZLhNJLZChmI1UV8Qu6/0VQFl FR1n8N6NEAbltsmTKq/Of6uS8bVxbA5ixW0OLeXeZeOkGfg9GChgAMxw8aqQGT6SR+vSw6A2Nr7 asuRbKfajEN+4wCPSnTrSXJdqeOHDOdstZKEvx5+9Hge91BWwked8XxNui4DsDTa6C7MeCIrloh hIwIeUn7BMN7xFZDNTgFHod6uDu2UV3TiR/vpNgx1B5FTQnESEtr0kfZ5qKiqt/y8i/eMFiokpg /+RBrLy64SyRWVTvG2cRJ//qakGtGa6iFYF2/9sPAkMtgLY+h426jINFfLhb4NisfgPqluF91WW UbvpZz3Jm9/uZtV6yujp9IqXlo X-Received: by 2002:a05:6a00:929d:b0:823:d2c:b156 with SMTP id d2e1a72fcca58-834dda870b4mr2351108b3a.5.1777364537850; Tue, 28 Apr 2026 01:22:17 -0700 (PDT) Received: from lgs.. ([152.32.133.247]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-834daf624d9sm1850084b3a.43.2026.04.28.01.22.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Apr 2026 01:22:17 -0700 (PDT) From: Guangshuo Li To: Mark Pearson , "Derek J. Clark" , Hans de Goede , =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= , Kurt Borja , platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH] platform/x86: think-lmi: fix possible memory leak in tlmi_sysfs_init() Date: Tue, 28 Apr 2026 16:22:07 +0800 Message-ID: <20260428082207.357522-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Once kobject_init_and_add() fails, kobject_put() should be called to decrement the reference count for cleanup. Otherwise, the memory associated with the object may leak. tlmi_sysfs_init() jumps to fail_create_attr after kobject_init_and_add() fails. The error path calls tlmi_release_attr(), which walks the kset lists and puts the kobjects found there. However, when the add operation fails, the kobject core removes the failed object from the kset list before returning the error. Therefore tlmi_release_attr() cannot put the kobject whose kobject_init_and_add() failed. Fix this by calling kobject_put() for the failed kobject before jumping to the common error path. Since pwd_admin's saved signatures are released outside of its kobject release callback, release them before putting a failed pwd_admin object. This issue was found by a static analysis tool I am developing. Fixes: 9110056fe10b ("platform/x86: think-lmi: Fix kobject cleanup") Signed-off-by: Guangshuo Li Reviewed-by: Kurt Borja Reviewed-by: Mark Pearson --- drivers/platform/x86/lenovo/think-lmi.c | 40 ++++++++++++++++++++----- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/drivers/platform/x86/lenovo/think-lmi.c b/drivers/platform/x86= /lenovo/think-lmi.c index e215e86e3db7..994475eb0b9c 100644 --- a/drivers/platform/x86/lenovo/think-lmi.c +++ b/drivers/platform/x86/lenovo/think-lmi.c @@ -1454,8 +1454,10 @@ static void tlmi_release_attr(void) kset_unregister(tlmi_priv.attribute_kset); =20 /* Free up any saved signatures */ - kfree(tlmi_priv.pwd_admin->signature); - kfree(tlmi_priv.pwd_admin->save_signature); + if (tlmi_priv.pwd_admin) { + kfree(tlmi_priv.pwd_admin->signature); + kfree(tlmi_priv.pwd_admin->save_signature); + } =20 /* Authentication structures */ list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, en= try) @@ -1526,8 +1528,11 @@ static int tlmi_sysfs_init(void) tlmi_priv.setting[i]->kobj.kset =3D tlmi_priv.attribute_kset; ret =3D kobject_init_and_add(&tlmi_priv.setting[i]->kobj, &tlmi_attr_set= ting_ktype, NULL, "%s", tlmi_priv.setting[i]->display_name); - if (ret) + if (ret) { + kobject_put(&tlmi_priv.setting[i]->kobj); + tlmi_priv.setting[i] =3D NULL; goto fail_create_attr; + } } =20 ret =3D sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &pending_reboo= t.attr); @@ -1548,33 +1553,52 @@ static int tlmi_sysfs_init(void) tlmi_priv.pwd_admin->kobj.kset =3D tlmi_priv.authentication_kset; ret =3D kobject_init_and_add(&tlmi_priv.pwd_admin->kobj, &tlmi_pwd_settin= g_ktype, NULL, "%s", "Admin"); - if (ret) + if (ret) { + kfree(tlmi_priv.pwd_admin->signature); + kfree(tlmi_priv.pwd_admin->save_signature); + tlmi_priv.pwd_admin->signature =3D NULL; + tlmi_priv.pwd_admin->save_signature =3D NULL; + kobject_put(&tlmi_priv.pwd_admin->kobj); + tlmi_priv.pwd_admin =3D NULL; goto fail_create_attr; + } =20 tlmi_priv.pwd_power->kobj.kset =3D tlmi_priv.authentication_kset; ret =3D kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_settin= g_ktype, NULL, "%s", "Power-on"); - if (ret) + if (ret) { + kobject_put(&tlmi_priv.pwd_power->kobj); + tlmi_priv.pwd_power =3D NULL; goto fail_create_attr; + } =20 if (tlmi_priv.opcode_support) { tlmi_priv.pwd_system->kobj.kset =3D tlmi_priv.authentication_kset; ret =3D kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_sett= ing_ktype, NULL, "%s", "System"); - if (ret) + if (ret) { + kobject_put(&tlmi_priv.pwd_system->kobj); + tlmi_priv.pwd_system =3D NULL; goto fail_create_attr; + } =20 tlmi_priv.pwd_hdd->kobj.kset =3D tlmi_priv.authentication_kset; ret =3D kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting= _ktype, NULL, "%s", "HDD"); - if (ret) + if (ret) { + kobject_put(&tlmi_priv.pwd_hdd->kobj); + tlmi_priv.pwd_hdd =3D NULL; goto fail_create_attr; + } =20 tlmi_priv.pwd_nvme->kobj.kset =3D tlmi_priv.authentication_kset; ret =3D kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_settin= g_ktype, NULL, "%s", "NVMe"); - if (ret) + if (ret) { + kobject_put(&tlmi_priv.pwd_nvme->kobj); + tlmi_priv.pwd_nvme =3D NULL; goto fail_create_attr; + } } =20 return ret; --=20 2.43.0