From nobody Sun Jul 26 01:48:38 2026 Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D137317150 for ; Fri, 10 Jul 2026 05:28:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783661303; cv=none; b=aenubt4yoCKYOYdv5z1ygWWLG/IuICRt438MhHuToEt9tF5sdsLVfzv4NE8Des+ex9+dmwS4zwr3tbO/AbF9AWaVLnmZRK/8E+W05ktoxE0bzEudEIzfNzabYte/CjG3Kk4UDlrC/aA406F1WEwIv1xpoxkL8XeAMLGBPf7Je8k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783661303; c=relaxed/simple; bh=I6qmZKmYgOCDd23juh8E1V8ly31ICCecziDj6Ab2yfs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=sK/jWrSGy7Awxq+DLTf8Zj0PTG7TyQNCAdqGGMBT+zfZ29pkz9ZmsXEj1W6G/cdZS6MKiJCSFFQ9XuVLUgqSCenGrPkDB52rArZCMultsBzZRCRRULYthSlpuI+iMxa1HlAtJ6B6xTbJBwfLOVr298j/hX5IoVaFG1YMKMLdQEE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in; spf=pass smtp.mailfrom=cse.iitm.ac.in; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20251104.gappssmtp.com header.i=@cse-iitm-ac-in.20251104.gappssmtp.com header.b=VYOQvi9O; arc=none smtp.client-ip=209.85.215.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20251104.gappssmtp.com header.i=@cse-iitm-ac-in.20251104.gappssmtp.com header.b="VYOQvi9O" Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-ca7bea5e5b3so439039a12.1 for ; Thu, 09 Jul 2026 22:28:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cse-iitm-ac-in.20251104.gappssmtp.com; s=20251104; t=1783661298; x=1784266098; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=mtgNPfiuPP2PxEYv19OKovNjnDZbOavqTWC7kRVkwjA=; b=VYOQvi9ORuhZUOM50E2rhusfmvI9IH/+CbWZ7mfqyoZiwXu3DydnAQYE1NsJb237ck 7SQ52aB4FSgZjM4h3+S8WnPFBrmkNtnxhz41BomM7htlf7zTS5qQGTDHZSd3sTPTLLS9 zvjzlqp24u+R5Ah4nuNfzvmeei0K9NqiWqYhZe+9uUQsEgfVnvwdiZqIPQSZ9XkbqVvr av5RXxir9YvMnR8M0tKcT4IPkiWuUTPwdvVtUAVWj4Uo2y0WhKQxxC0RaHvRA+DKSjx+ tFoFGy55mKGZsQ+bSmSsyyGJuwsuhOZhGOOUvbZY0hYECUiAOtcENxNhvkkFuVHgOBvF iSEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783661298; x=1784266098; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=mtgNPfiuPP2PxEYv19OKovNjnDZbOavqTWC7kRVkwjA=; b=Ln9yqsPmNTOAlBQxlLMmOUp5UDivJx4Zgjuxg+6Ejp17S7LfFstQfUim8jqT5RUNrt 1YsRuF7mM9xs3C/uMuI+7ksdUlFHLkcrxP645/RcD339qgQ+eZ+Wn667SiKD4jKZmltM 5Gd82SUEli7BCXBa0fk2b34GElwxHBf2J6CQWbq1a+4mp1s8Uxphm8fjNHvHbKFR8NFj 0eweYUfWgUcock2+QlA9ohtfm2m/GcijJ52u8wpQfxy1A47pVxH+nxpLzjWITeA0RoaU q+MJ51Qov93xcNhr1A7qfjMwNB2LxIFkAYQLNgRnstsobdsIBJ81vdyrUa1UsOdJI7RB 1VwA== X-Forwarded-Encrypted: i=1; AHgh+Rq/CobIhO+qf8s/dbM8mlxlb0MO+2fNbDFVl9y0feDe26Y5ASjVHjiteQezVnvATcqJwHiTiQAOz0SAN/k=@vger.kernel.org X-Gm-Message-State: AOJu0YyLctz/l23fyikQR23nUpMPt98R3KKzXU/rOjwqia8lIRM6tlwE /oL1I8NlbVWYU8KQRKe2k3yWwwQwcCQQbF7hwkHolrXUi4IXCwn7EE4dSoBYj6c9pWs= X-Gm-Gg: AfdE7cmDN6ykNQUmFRwrkBLFbdTTkyuRofCxOIqVR7H5nR+tqV52l5mX2rQMC9nvild 5NJ1DUQjD9BEfblNUk57Skl5UXDLGBEZrLfVChAh/tCocyP6ISoDUzeojI2qT3ewPfFbe62x13t lZTlQ7us37smJrRmJajia2bkMC+mJId9B7vc4E4jsE55CxeNIJTk2c19jszzlaOllw6GApzp/gE +J+ODUQqMgUX8Ue3dSTpPKANCQomiycnc7I5EyPeUfCgYweBWMbXGtpQsAKufDE7idm/U6KF036 i/lnsQwYYMZ+BPsslKcMBVuXyiONx7XmeKl4RiNDAs9ITRkvxD/EAK+kp72jKbgf5r+W2etGO3B z4so+Jx5Jz70oKmp06ftUty9Ewq779NPkH8fP/6L4ntIQzxBBeqnEJUvTqdYPnLrVxlMpQqx/AM 4cr42WCpq/FQbzWCFqq3OHqSJ+Z2Gv6bwZE8odIgW4GzmeC6EwQgPGFBW4DUUqZSG1DiSDKXCSn 495tNaI1ML3JnhywqTWQ28qzlDXQB55T+Au/RKt2Zw= X-Received: by 2002:a05:6a21:7a9c:b0:3bf:9c93:ac44 with SMTP id adf61e73a8af0-3c0bcfea4bcmr12603274637.19.1783661298383; Thu, 09 Jul 2026 22:28:18 -0700 (PDT) Received: from Metius.iitm.ac.in ([103.158.43.43]) by smtp.googlemail.com with ESMTPSA id a92af1059eb24-13b659d8da9sm62526530c88.14.2026.07.09.22.28.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Jul 2026 22:28:17 -0700 (PDT) From: Abdun Nihaal To: s.shravan@intel.com Cc: Abdun Nihaal , hansg@kernel.org, ilpo.jarvinen@linux.intel.com, platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2] platform/x86: int1092: Fix potential memory leak in sar_probe() Date: Fri, 10 Jul 2026 10:58:03 +0530 Message-ID: <20260710052806.100107-1-nihaal@cse.iitm.ac.in> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The memory allocated for device_mode_info in parse_package() called by sar_get_data() is not freed in some of the error paths in sar_probe(). Fix that by converting to use device managed allocations. Fixes: dcfbd31ef4bc ("platform/x86: BIOS SAR driver for Intel M.2 Modem") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal --- Compile tested only. Issue found using static analysis. v1->v2: - Changed the patch to instead use device managed allocations for both the device_mode_info and the context structure, as suggested by Ilpo J=C3=A4rvinen. Link to v1: https://patchwork.kernel.org/project/platform-driver-x86/patch/= 20260707070524.953741-1-nihaal@cse.iitm.ac.in/ .../platform/x86/intel/int1092/intel_sar.c | 30 +++++-------------- 1 file changed, 8 insertions(+), 22 deletions(-) diff --git a/drivers/platform/x86/intel/int1092/intel_sar.c b/drivers/platf= orm/x86/intel/int1092/intel_sar.c index 849f7b415c1e..f234e1f55aec 100644 --- a/drivers/platform/x86/intel/int1092/intel_sar.c +++ b/drivers/platform/x86/intel/int1092/intel_sar.c @@ -91,8 +91,8 @@ static acpi_status parse_package(struct wwan_sar_context = *context, union acpi_ob item->package.count <=3D data->total_dev_mode) return AE_ERROR; =20 - data->device_mode_info =3D kmalloc_objs(struct wwan_device_mode_info, - data->total_dev_mode); + data->device_mode_info =3D devm_kmalloc_array(&context->sar_device->dev, + data->total_dev_mode, sizeof(*data->device_mode_info), GFP_KERNEL); if (!data->device_mode_info) return AE_ERROR; =20 @@ -253,7 +253,7 @@ static int sar_probe(struct platform_device *device) if (!handle) return -ENODEV; =20 - context =3D kzalloc_obj(*context); + context =3D devm_kzalloc(&device->dev, sizeof(*context), GFP_KERNEL); if (!context) return -ENOMEM; =20 @@ -264,7 +264,7 @@ static int sar_probe(struct platform_device *device) result =3D guid_parse(SAR_DSM_UUID, &context->guid); if (result) { dev_err(&device->dev, "SAR UUID parse error: %d\n", result); - goto r_free; + return result; } =20 for (reg =3D 0; reg < MAX_REGULATORY; reg++) @@ -272,43 +272,29 @@ static int sar_probe(struct platform_device *device) =20 if (sar_get_device_mode(device) !=3D AE_OK) { dev_err(&device->dev, "Failed to get device mode\n"); - result =3D -EIO; - goto r_free; + return -EIO; } =20 result =3D sysfs_create_group(&device->dev.kobj, &intcsar_group); if (result) { dev_err(&device->dev, "sysfs creation failed\n"); - goto r_free; + return result; } =20 if (acpi_install_notify_handler(ACPI_HANDLE(&device->dev), ACPI_DEVICE_NO= TIFY, sar_notify, (void *)device) !=3D AE_OK) { dev_err(&device->dev, "Failed acpi_install_notify_handler\n"); - result =3D -EIO; - goto r_sys; + sysfs_remove_group(&device->dev.kobj, &intcsar_group); + return -EIO; } return 0; - -r_sys: - sysfs_remove_group(&device->dev.kobj, &intcsar_group); -r_free: - kfree(context); - return result; } =20 static void sar_remove(struct platform_device *device) { - struct wwan_sar_context *context =3D dev_get_drvdata(&device->dev); - int reg; - acpi_remove_notify_handler(ACPI_HANDLE(&device->dev), ACPI_DEVICE_NOTIFY, sar_notify); sysfs_remove_group(&device->dev.kobj, &intcsar_group); - for (reg =3D 0; reg < MAX_REGULATORY; reg++) - kfree(context->config_data[reg].device_mode_info); - - kfree(context); } =20 static struct platform_driver sar_driver =3D { --=20 2.43.0