From nobody Sat Jul 25 21:57:09 2026 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 27A2E370D69 for ; Mon, 13 Jul 2026 11:02:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783940566; cv=none; b=uwly8axLJkyOHbSWItO06AmpbP3mLRi9hOel3VEH/dU1fe6ulYSRWiO7DAhqe/gXvY/nocAyuWUo4njPBai4W/JLEpF8u1q8Dl0ysnGb2MyYnDbosfCQlVamewcuxjJGgEajp0pbMgv856aw7W75mn17bce/ocYm5IrHwNjVA4o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783940566; c=relaxed/simple; bh=XdMxzd8iDKQr5PS2zIsnUUypJpLDZzPkZaQ7qmg2evU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=aLkra6zBd9Fbs/xA7ashdm/IJjac6hFFjssPRVrd25dgilxyPQnCCRRv620iYJwBq/tTB9Z4+63N+0KmiELPOub0kmeolp67tnL2jVb6mnirIWf3klagBiyBjfNG4T26HU/zn9SHhcPhzspTiuGnWdzI1nP7LQ21fWJMod9FfYY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in; spf=pass smtp.mailfrom=cse.iitm.ac.in; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20251104.gappssmtp.com header.i=@cse-iitm-ac-in.20251104.gappssmtp.com header.b=Vv6Mp1Qt; arc=none smtp.client-ip=209.85.215.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20251104.gappssmtp.com header.i=@cse-iitm-ac-in.20251104.gappssmtp.com header.b="Vv6Mp1Qt" Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-c9e7391839cso2683037a12.0 for ; Mon, 13 Jul 2026 04:02:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cse-iitm-ac-in.20251104.gappssmtp.com; s=20251104; t=1783940563; x=1784545363; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=FFFSD3/CjVLS0ezRz/CdhSHYIzRiivgohq9ZOTv9sGc=; b=Vv6Mp1QtQSZ0TwbktUQjHmCzOuOnyqIkcvYujltX5uarPgxHuEvLrfQUW0Lwnbg7oK 4Zn2kucqQaHe0LyQyy5kZ+OFNBcQMV2IO3cVFV4jjXIJ/jF3jVTWrirkNNaVXUTr472R MKPhAU7bkTfXX9WgFREkhBsGzrE+Q+j2cdnbItXAtYKFcOWeR24F8mVFkMOP3jCBwsIt cRE5Tp+XMCp0+w9Bq5pAUODODLuCWlrzONPwC3GRE1kgNwkzf+JeUz20gio5q65Zc24a nFOHMgG1nkk5ly88hw0dDanZsMTOvlFGQiscoy7OWFhvsBd+kb3Td4XX3uKUZQRM6BPA LZAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783940563; x=1784545363; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=FFFSD3/CjVLS0ezRz/CdhSHYIzRiivgohq9ZOTv9sGc=; b=fV+IxoeU13zmp4vxgSsychj/d5FE23N9oWD5eEeByDOjBOHp5UahrCzUmUVyXTJpPe Tc/d2y6sOQgfrkgxUj9RT8YDtnRtRWC5lPX7B3dCslPW1FRqh95RHfE1L8tg5Tj48kyq lRMR9uSJxBrJLPb1PUlsaTHIKXd3udfw+dtb44iU4sO6uW4X+65BH9t26SMhweV0jr+/ Xfx5+mkYoC0u0axRZN3GVwNVLPTLvTfu7JlmT57yEF1eemb3QqTTF0ZzvM625rn8qnxO sOz784/MR+3mrjNg7xGS6dyZDDXjmVT5AowiHbeYJNghuNixn10HLH/uuzQa2dC97xbA wahg== X-Forwarded-Encrypted: i=1; AHgh+Rrgcl6K/dHbAw9pN2Q59eWRuZXPsWQr4HuIS62lF4nzE8aJ6sC09lg4pVVu8iIssN1ulygsHCe5EMd0oAA=@vger.kernel.org X-Gm-Message-State: AOJu0YyzPVNybJs5h3p49byy+vR46/+0C14GLo83QOWnHLjrkmui8P9L X2zKYTi7fUrN8ijU1rGm3n5BRSs2V7NrqxxwXEFsMrB8iM9la3oS/JjrqJWhjy7ZhTn3wP9KYSE +VJXJleI= X-Gm-Gg: AfdE7ck3mV1gwBzF8RyaoeSR+2LDiio/uMH4AqZm98qfmQu7XsJCOIGZ0SPtTiyFcAC CGPB05jWb9bayh7Ef82nYhQTCmF4mMMY9+pud5TkNf4N24UUKq9z/6mg3ZUrOdaX4awbQ/sDXvd XdWO0im7/cre3OnXN/F2L+QUB6ejUp8SPyUWQo6zjhPP3oEg7s6NSc3zhIMtGrcmhyKGePp99WQ 2zrxy9MAm7nCqlt10zhFbxtiOI1NGq/ibK3iEOKEKy8i/QJRoWZ4eSRF9eASzdxuJgW6p/bZTST HTHXQDfm6E/DOSuS5N8xc7/dvSEFGR343UYd0gum6pQEy8D2UKn3KGJeXmWjA2O3KI+KBDGWRST QqxpjNQ4Ey5kGiKcXp9Z9GhQ1cqXJVk2TcGP8h9WDEfSMdGZfDwkZ0ftRxo+mWDXWTsW55J3d0m 8F225wA/tHMlB+Bh17Rk0ujKYQgGOW5Um7Rf0Yjecen8fmtTvmng5+edW+cO5CtNdzV/qp1h/mW xN1HW+dusiZtTO2rv8nl+EXwh+rUmiWnIk= X-Received: by 2002:a05:6a20:b7a7:b0:3c0:9c1b:d0b2 with SMTP id adf61e73a8af0-3c1108c2c0amr8860918637.61.1783940563499; Mon, 13 Jul 2026 04:02:43 -0700 (PDT) Received: from [127.0.1.1] ([103.158.43.43]) by smtp.googlemail.com with ESMTPSA id 5a478bee46e88-311a6115e61sm52249087eec.22.2026.07.13.04.02.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 04:02:43 -0700 (PDT) From: Abdun Nihaal Date: Mon, 13 Jul 2026 16:32:24 +0530 Subject: [PATCH 1/2] platform/x86: int1092: Fix potential memory leak in sar_probe() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260713-platx86-v1-1-c8991bff03a0@cse.iitm.ac.in> References: <20260713-platx86-v1-0-c8991bff03a0@cse.iitm.ac.in> In-Reply-To: <20260713-platx86-v1-0-c8991bff03a0@cse.iitm.ac.in> To: Shravan Sudhakar , Hans de Goede , =?utf-8?q?Ilpo_J=C3=A4rvinen?= Cc: platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Abdun Nihaal X-Mailer: b4 0.13.0 The memory allocated for device_mode_info in parse_package() called by sar_get_data() is not freed in some of the error paths in sar_probe(). Fix that by converting to use device managed allocations. Fixes: dcfbd31ef4bc ("platform/x86: BIOS SAR driver for Intel M.2 Modem") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal --- Compile tested only. Issue found using static analysis. v1->v2: - Changed the patch to instead use device managed allocations for both the device_mode_info and the context structure, as suggested by Ilpo J=C3=A4rvinen. v2->v3: - Align the arguments to the opening paranthesis as suggested by Ilpo J=C3=A4rvinen. Link to v1: https://patchwork.kernel.org/project/platform-driver-x86/patch/= 20260707070524.953741-1-nihaal@cse.iitm.ac.in/ Link to v2: https://patchwork.kernel.org/project/platform-driver-x86/patch/= 20260710052806.100107-1-nihaal@cse.iitm.ac.in/ --- drivers/platform/x86/intel/int1092/intel_sar.c | 32 ++++++++--------------= ---- 1 file changed, 10 insertions(+), 22 deletions(-) diff --git a/drivers/platform/x86/intel/int1092/intel_sar.c b/drivers/platf= orm/x86/intel/int1092/intel_sar.c index 849f7b415c1e..7263114f0b3d 100644 --- a/drivers/platform/x86/intel/int1092/intel_sar.c +++ b/drivers/platform/x86/intel/int1092/intel_sar.c @@ -91,8 +91,10 @@ static acpi_status parse_package(struct wwan_sar_context= *context, union acpi_ob item->package.count <=3D data->total_dev_mode) return AE_ERROR; =20 - data->device_mode_info =3D kmalloc_objs(struct wwan_device_mode_info, - data->total_dev_mode); + data->device_mode_info =3D devm_kmalloc_array(&context->sar_device->dev, + data->total_dev_mode, + sizeof(*data->device_mode_info), + GFP_KERNEL); if (!data->device_mode_info) return AE_ERROR; =20 @@ -253,7 +255,7 @@ static int sar_probe(struct platform_device *device) if (!handle) return -ENODEV; =20 - context =3D kzalloc_obj(*context); + context =3D devm_kzalloc(&device->dev, sizeof(*context), GFP_KERNEL); if (!context) return -ENOMEM; =20 @@ -264,7 +266,7 @@ static int sar_probe(struct platform_device *device) result =3D guid_parse(SAR_DSM_UUID, &context->guid); if (result) { dev_err(&device->dev, "SAR UUID parse error: %d\n", result); - goto r_free; + return result; } =20 for (reg =3D 0; reg < MAX_REGULATORY; reg++) @@ -272,43 +274,29 @@ static int sar_probe(struct platform_device *device) =20 if (sar_get_device_mode(device) !=3D AE_OK) { dev_err(&device->dev, "Failed to get device mode\n"); - result =3D -EIO; - goto r_free; + return -EIO; } =20 result =3D sysfs_create_group(&device->dev.kobj, &intcsar_group); if (result) { dev_err(&device->dev, "sysfs creation failed\n"); - goto r_free; + return result; } =20 if (acpi_install_notify_handler(ACPI_HANDLE(&device->dev), ACPI_DEVICE_NO= TIFY, sar_notify, (void *)device) !=3D AE_OK) { dev_err(&device->dev, "Failed acpi_install_notify_handler\n"); - result =3D -EIO; - goto r_sys; + sysfs_remove_group(&device->dev.kobj, &intcsar_group); + return -EIO; } return 0; - -r_sys: - sysfs_remove_group(&device->dev.kobj, &intcsar_group); -r_free: - kfree(context); - return result; } =20 static void sar_remove(struct platform_device *device) { - struct wwan_sar_context *context =3D dev_get_drvdata(&device->dev); - int reg; - acpi_remove_notify_handler(ACPI_HANDLE(&device->dev), ACPI_DEVICE_NOTIFY, sar_notify); sysfs_remove_group(&device->dev.kobj, &intcsar_group); - for (reg =3D 0; reg < MAX_REGULATORY; reg++) - kfree(context->config_data[reg].device_mode_info); - - kfree(context); } =20 static struct platform_driver sar_driver =3D { --=20 2.43.0 From nobody Sat Jul 25 21:57:09 2026 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 804DB340DA6 for ; Mon, 13 Jul 2026 11:02:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783940568; cv=none; b=F9KEa668Gigq1xH1w0KHIVZsVHIRhcck2vMtFOwBOtxBYpfjdjD5L3ieMWJqY5RSH1XZa9epElFImGBiMmzehg2gyguxOqe6kvxPKGFmWZJu9iLBm+tFEu2Qtj3UIc0bFiRDcshqIu5npAdvc3hQCmIneCa8GIHeyY1biLGHbVw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783940568; c=relaxed/simple; bh=GH6CWop3wfi/VJkvt4cMc0bNyzCTH1KmyzTlNjCz/68=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=qaSc4WOnPL0ycKr61Y8oQVirFEEiGm+rTZRNkSamRU74YQIQxpPnvhwdcy3ALud5Wl/sFCIeHb5KwoW+G7f8UObFZSAFp/R3PrPNHL3Ll5o8AjgBmLCLLHeslInLP0L1HPvmuKpbEvLUr7ICxeAkjb2e8u1dN7Y55IWTCRXUyNQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in; spf=pass smtp.mailfrom=cse.iitm.ac.in; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20251104.gappssmtp.com header.i=@cse-iitm-ac-in.20251104.gappssmtp.com header.b=AHazjOTx; arc=none smtp.client-ip=209.85.216.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20251104.gappssmtp.com header.i=@cse-iitm-ac-in.20251104.gappssmtp.com header.b="AHazjOTx" Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-38dcbade417so1342267a91.1 for ; Mon, 13 Jul 2026 04:02:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cse-iitm-ac-in.20251104.gappssmtp.com; s=20251104; t=1783940567; x=1784545367; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=eWk91/IxILRwPoM0aUwUrJJrk3OrtAhlG6TmoK3LV2g=; b=AHazjOTxZXhs+0eTkazPjKH1+t7SKypGWHx0dKqpGI1DoctrYPpWB8KkXGqoVGqp9y 4JU951f8j55I4rB5GlouCvpAUZSnXRCz1+X2Lvg1UemKndz5mYQIK2j2n9wq77Pb8IhB qcw43pAZAUc5RkcrODQNjhKN8lfu6FqHgRcKyIGPA5tlfK53k46Rhp1jZaaTNRAuBaHj lWSFKKAZ4cvD2jU9pjJR64LLRIWkSnsM9tj31LyWYwrY5hFnWf2bSMeKHzNnyiVFJrb1 OijaweVRePRg0tgX0okuuAddUxy9fujbKEl5HWnDzEDxi1HFStJ9XNTNpA9iuWd2KOWY aSyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783940567; x=1784545367; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=eWk91/IxILRwPoM0aUwUrJJrk3OrtAhlG6TmoK3LV2g=; b=HoCFbY9+THtuwdpiBMmb1n/BguFkDt07ydJSyVAma64JSE1r66c5OlHpPbeDpp/+bo 4rfI5gWGwTMYbUbqIw2H9d8KsNwm+pXBBSxEbvCPGCYTEEXSy1z5gpykAJ2lnvd38uPD KOZIFPMy/B8lFUoI2OFoW/uGjroLQYzzK7wcHwzfbWONvoTbaVd7Jrf8YDFbikiAUYNG qoCHCmtUZg+WcnkHGML1CNDgfS1sdf6SSX/dNqQJlo1QRhw3+qx9H89GpFlmyG5Gm2rV Vjylii+TGcbmr8cX6DZRe1WjDMP5b40B24saIes89V1+o6dwEmZcXNrczLmsmsx2Kgrg qtpg== X-Forwarded-Encrypted: i=1; AHgh+RpvaBWz2o8zN3Y9dTqZygIZ6FvrYq3hdKxT6Ybtsi2Knb1UcaRNOQqjGz4GU2eA8JX3imXE6WitNbDZlWU=@vger.kernel.org X-Gm-Message-State: AOJu0YznHFWX9UsSbEd0VKrbbt569+VM1jmQiby9AILA+munIQTd7ZN0 uPKzltyvAxs5bLVOBkyLyUberH30HaQSPqt0cI7f6xtO/+O8XTCaqv4Uf/ty7F1gaHF9wJa29fy sJ/rPpXw= X-Gm-Gg: AfdE7clTupn7hucheygTT5o8bnXV0ED2H6v0Gf3nl+LjckYfbpkm+Rq73+dEevIg2uW qGf5/kSXjITT+NUjt9alki07n+JiDSsGh5F3Occ5U8KLWDuRNJSl13qnAYr9nJymuY1Q6Iwfwo5 cY5Pz+Moh+fIzfdVdXeBDvG065P4//tc2Pjm0vXmfxkobXEx1ChLdOLQ/Ox/rLFSDFPbYiqUJYM ZhGxPo5q9lAv1wYisXxv/4BeDf2bMxkD58O/ub/icO1inoLq4pNcodxms0l3xqT57B4DzWU6qHt YwCiiTcLVLFhHh0vaqAqnaLmQkokDB6IIzclPUNVitgddH1q5md6KoHJTop/+upH+81/v6pOE25 GzJvca4Ve2djPnbJdaQbw6qF4KMMSoOQPnHFG0coWNhh30aDzgqoT2biinE8DUebuKm1cDOubXd DharR4dSZ+AFj0JFn4jQ6SSkCVH4C7uw4hg1LzVfGZs6mhynFgkR6sjGrs2AUbs6i/Y9Lamw7jB YkJNhGYt0zACEmdVCicXKowdl0ALxbWyTE= X-Received: by 2002:a05:6a20:7491:b0:3c0:9c1a:893e with SMTP id adf61e73a8af0-3c110f7f4e5mr8654866637.70.1783940566955; Mon, 13 Jul 2026 04:02:46 -0700 (PDT) Received: from [127.0.1.1] ([103.158.43.43]) by smtp.googlemail.com with ESMTPSA id 5a478bee46e88-311a6115e61sm52249087eec.22.2026.07.13.04.02.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 04:02:46 -0700 (PDT) From: Abdun Nihaal Date: Mon, 13 Jul 2026 16:32:25 +0530 Subject: [PATCH 2/2] platform/x86: int1092: Fix info leak in parse_package() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260713-platx86-v1-2-c8991bff03a0@cse.iitm.ac.in> References: <20260713-platx86-v1-0-c8991bff03a0@cse.iitm.ac.in> In-Reply-To: <20260713-platx86-v1-0-c8991bff03a0@cse.iitm.ac.in> To: Shravan Sudhakar , Hans de Goede , =?utf-8?q?Ilpo_J=C3=A4rvinen?= Cc: platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Abdun Nihaal , Sashiko X-Mailer: b4 0.13.0 Sashiko reports a possible information leak due to a non-zeroized memory allocation for device_mode_info. Fix that by switching to use devm_kcalloc() for allocation. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260710052806.100107-1-nihaal%40cse= .iitm.ac.in Signed-off-by: Abdun Nihaal --- Newly added in v3 --- drivers/platform/x86/intel/int1092/intel_sar.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/platform/x86/intel/int1092/intel_sar.c b/drivers/platf= orm/x86/intel/int1092/intel_sar.c index 7263114f0b3d..f506155f35d4 100644 --- a/drivers/platform/x86/intel/int1092/intel_sar.c +++ b/drivers/platform/x86/intel/int1092/intel_sar.c @@ -91,10 +91,10 @@ static acpi_status parse_package(struct wwan_sar_contex= t *context, union acpi_ob item->package.count <=3D data->total_dev_mode) return AE_ERROR; =20 - data->device_mode_info =3D devm_kmalloc_array(&context->sar_device->dev, - data->total_dev_mode, - sizeof(*data->device_mode_info), - GFP_KERNEL); + data->device_mode_info =3D devm_kcalloc(&context->sar_device->dev, + data->total_dev_mode, + sizeof(*data->device_mode_info), + GFP_KERNEL); if (!data->device_mode_info) return AE_ERROR; =20 --=20 2.43.0