From nobody Fri Jul 24 05:24:08 2026 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 235924A13AE for ; Thu, 23 Jul 2026 12:44:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784810691; cv=none; b=DfCgyNuSWwxdMBeeXGLDPOVDGo+WxGn63OKMvEKTN/Iexn5JUdO0W5ZVt7rpZaKthYBx8zAmD/lPFHeCRbSAfTxxLZTVK2rVQ+McWFTvdkT6NXX0eL0vSnlc5GQoyq8X44JpKkKn2YZFHlzUzc88vWpOFXwftszKXWBC2hoDaWw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784810691; c=relaxed/simple; bh=PfHJYqAdNUNso9QIi/a1PoUrfQ4churnV2g+9V85fDE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Bo8xQjNG31FqBpHdl3LLA6hy8dvldKpry0HdOtqHIaAx6PQaW/qqitrJPIku077qYT43M3wUEvVfM+9gwj7M/xoxX/EvWHo5oTCRN6ITcQNec2oJfGG8X5autmFNrLE2vLbg9y+MXoALbxj00xAuUQXpq157hdL1POtGlhmfbZM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in; spf=pass smtp.mailfrom=cse.iitm.ac.in; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20251104.gappssmtp.com header.i=@cse-iitm-ac-in.20251104.gappssmtp.com header.b=NZcD67tG; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20251104.gappssmtp.com header.i=@cse-iitm-ac-in.20251104.gappssmtp.com header.b="NZcD67tG" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-381216921aaso515080a91.1 for ; Thu, 23 Jul 2026 05:44:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cse-iitm-ac-in.20251104.gappssmtp.com; s=20251104; t=1784810687; x=1785415487; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=hiPXGv4jgjzWQcJFciSEaz+MHyjRNnFYQcUtVupcsGc=; b=NZcD67tG6Rx/0xeEYtDNRtHDUf73GhTBotoqwwKXKcJWLA+Br7KBLH24ftX0w32vmi l1QE7HKbvWuFOV8etmtsI6J7klcZYa+pvLAVKF589b43qUCQxS9BOb3SdkbbiSN1/4zW RhnO82ZjouOYFTzpm84giPSnlYf7DB/qzcc3TQsWAZEeK3UjjJDEVrPFJvtjLRyYLLAd B5qy3u2D4juQo9eHPWup+3G/bMnfjSzXC6zlGoK7HhyfiuBtFY528d1l0DPc9mENwzWZ 36MDxTA1XaU1HHbUAIQW/8aNq8F4St+JzZMfm5sAxVzjwPexM+v1QbcZV6IGj+iRqe3+ QUsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784810687; x=1785415487; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=hiPXGv4jgjzWQcJFciSEaz+MHyjRNnFYQcUtVupcsGc=; b=lW9rNeqo1dnuKTsfFnjLqnh32qCGBSkavf6r0mv7+ug63asi9q7gshhPCvl6aPLauy 59n5PDfjQm3ltz8ijJCyQQlxy/PJLYSFGYBtLVvsph611+NWhZmYIA2at3QBCU+IXT4F TrKDpvhhnuh0xXE1vWpgxoqWVFMq9SPuwX+OJBsx3bFyrYgQuiX8f33IIml9T+i4FN7r ZWvutjdpqKZeagcV/mO8bmU5Av0guV9n5kkuQ0huYE8U2Uy1qepAOdTX4Q/bDc7RNx4b XYN0ApQ83hr7oeLuQp6UHgX9/ElLQoxJXGXHU2p9RxZLPRiaa+jiGXuwawtyMGe/ENKO /wMA== X-Forwarded-Encrypted: i=1; AHgh+RpmscUXby6S3avujGIxLsr4nm44DdGPn69PKD+YRBATU41ASG+WuMjrw2vcBKvsiHiAZS4iUadnaup4lak=@vger.kernel.org X-Gm-Message-State: AOJu0Yw1T1Ru2KQxoJtQbexFYRw/Cm92k8H3kwfcHLwl3vzvY5DMDEsz 13qooBla0wZqj2oXMeGvdNqtpDmbGEUyifjeGHvdq1Q1DG3QGGpNztTuq4HYrDPzeS8= X-Gm-Gg: AR+sD10JaR/lXCNJ0oQxXdzgk9+FNrMbETcIEtCu6nIcuyQCcWdWdfYTEXVLAAiLCBh 4m8ehbK1vM+yvlf1qV+xY+lCcjj75WRa0YhVZ8kvgConmNMt1REwXF1N/H2mm0lVWbt273kaXA2 EO7oJyCxZN0b15ERJ+LZzHISiuxJ9g3tDgi/+vuNXEqqyIuR30rlau5zkMdnu3huYy9R8sKZJFz QyxG0qgp8a3yCTlPuOAjMbgtYRUDgCcgAJS6C/2NYLct1COD9KJxLeAd4bnqLP/Mj7KM/54X0p/ 6jHHyhiOJIOggLTm4hDhdaDSRL6T3edjyrmNukmLfK0SfRyVY0jnfkw623RVA3qud7zauQPK+/V 6VqpBo6MYQgYh1F6a84uQ1KGoezHNdDRlxGDNPz9xsz9UdI6d+VVmpTdYla5SnpgCxh/5yFt8ui c6ug/209O4nQ1C54Ders92hEfbv2n8hxfkjvhEvK0NFi9QgZYpxZK26WWKvd6eMz5x7bEAyghvS Hl+vIKyQYwSPW9KfebH6DaX X-Received: by 2002:a17:90b:2b88:b0:38e:ab33:9551 with SMTP id 98e67ed59e1d1-38ec66604ddmr2925445a91.42.1784810686968; Thu, 23 Jul 2026 05:44:46 -0700 (PDT) Received: from [127.0.1.1] ([103.158.43.43]) by smtp.googlemail.com with ESMTPSA id a92af1059eb24-13d1300401fsm21663197c88.3.2026.07.23.05.44.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 05:44:46 -0700 (PDT) From: Abdun Nihaal Date: Thu, 23 Jul 2026 18:14:15 +0530 Subject: [PATCH v4 1/2] platform/x86: int1092: Fix potential memory leak in sar_probe() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260723-platx86-v4-1-93b4a178b595@cse.iitm.ac.in> References: <20260723-platx86-v4-0-93b4a178b595@cse.iitm.ac.in> In-Reply-To: <20260723-platx86-v4-0-93b4a178b595@cse.iitm.ac.in> To: Shravan Sudhakar , Hans de Goede , =?utf-8?q?Ilpo_J=C3=A4rvinen?= Cc: platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Abdun Nihaal X-Mailer: b4 0.13.0 The memory allocated for device_mode_info in parse_package() called by sar_get_data() is not freed in some of the error paths in sar_probe(). Fix that by converting to use device managed allocations. Fixes: dcfbd31ef4bc ("platform/x86: BIOS SAR driver for Intel M.2 Modem") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal --- Compile tested only. Issue found using static analysis. v1->v2: - Changed the patch to instead use device managed allocations for both the device_mode_info and the context structure, as suggested by Ilpo J=C3=A4rvinen. v2->v3: - Align the arguments to the opening paranthesis as suggested by Ilpo J=C3=A4rvinen. v3->v4: - No change Link to v1: https://patchwork.kernel.org/project/platform-driver-x86/patch/= 20260707070524.953741-1-nihaal@cse.iitm.ac.in/ Link to v2: https://patchwork.kernel.org/project/platform-driver-x86/patch/= 20260710052806.100107-1-nihaal@cse.iitm.ac.in/ --- drivers/platform/x86/intel/int1092/intel_sar.c | 32 ++++++++--------------= ---- 1 file changed, 10 insertions(+), 22 deletions(-) diff --git a/drivers/platform/x86/intel/int1092/intel_sar.c b/drivers/platf= orm/x86/intel/int1092/intel_sar.c index 849f7b415c1e..7263114f0b3d 100644 --- a/drivers/platform/x86/intel/int1092/intel_sar.c +++ b/drivers/platform/x86/intel/int1092/intel_sar.c @@ -91,8 +91,10 @@ static acpi_status parse_package(struct wwan_sar_context= *context, union acpi_ob item->package.count <=3D data->total_dev_mode) return AE_ERROR; =20 - data->device_mode_info =3D kmalloc_objs(struct wwan_device_mode_info, - data->total_dev_mode); + data->device_mode_info =3D devm_kmalloc_array(&context->sar_device->dev, + data->total_dev_mode, + sizeof(*data->device_mode_info), + GFP_KERNEL); if (!data->device_mode_info) return AE_ERROR; =20 @@ -253,7 +255,7 @@ static int sar_probe(struct platform_device *device) if (!handle) return -ENODEV; =20 - context =3D kzalloc_obj(*context); + context =3D devm_kzalloc(&device->dev, sizeof(*context), GFP_KERNEL); if (!context) return -ENOMEM; =20 @@ -264,7 +266,7 @@ static int sar_probe(struct platform_device *device) result =3D guid_parse(SAR_DSM_UUID, &context->guid); if (result) { dev_err(&device->dev, "SAR UUID parse error: %d\n", result); - goto r_free; + return result; } =20 for (reg =3D 0; reg < MAX_REGULATORY; reg++) @@ -272,43 +274,29 @@ static int sar_probe(struct platform_device *device) =20 if (sar_get_device_mode(device) !=3D AE_OK) { dev_err(&device->dev, "Failed to get device mode\n"); - result =3D -EIO; - goto r_free; + return -EIO; } =20 result =3D sysfs_create_group(&device->dev.kobj, &intcsar_group); if (result) { dev_err(&device->dev, "sysfs creation failed\n"); - goto r_free; + return result; } =20 if (acpi_install_notify_handler(ACPI_HANDLE(&device->dev), ACPI_DEVICE_NO= TIFY, sar_notify, (void *)device) !=3D AE_OK) { dev_err(&device->dev, "Failed acpi_install_notify_handler\n"); - result =3D -EIO; - goto r_sys; + sysfs_remove_group(&device->dev.kobj, &intcsar_group); + return -EIO; } return 0; - -r_sys: - sysfs_remove_group(&device->dev.kobj, &intcsar_group); -r_free: - kfree(context); - return result; } =20 static void sar_remove(struct platform_device *device) { - struct wwan_sar_context *context =3D dev_get_drvdata(&device->dev); - int reg; - acpi_remove_notify_handler(ACPI_HANDLE(&device->dev), ACPI_DEVICE_NOTIFY, sar_notify); sysfs_remove_group(&device->dev.kobj, &intcsar_group); - for (reg =3D 0; reg < MAX_REGULATORY; reg++) - kfree(context->config_data[reg].device_mode_info); - - kfree(context); } =20 static struct platform_driver sar_driver =3D { --=20 2.43.0 From nobody Fri Jul 24 05:24:08 2026 Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E9704A2E1D for ; Thu, 23 Jul 2026 12:44:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784810693; cv=none; b=qN7TpT+Tw6BGHEF0OofcTBZuQsU+mTcMYIQBicHYW3Nnia3JodfxbeIrb5yxGA/87WPXi4bdK4jvu3Ks19XJN/pS0N6j/KxYOS7C9tOrlmin8PPZJkInS4z9e51ccUG6luXqsfhRAVkzuNfs7Yvx9JKv0mjec+Vb2rfsDhAcigc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784810693; c=relaxed/simple; bh=Xig7WGnnLktfSt85EJ7ZIzdmITHXE3yWx24ihdGcLcg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=PC0pjkoBE5KVjG/9dOBk4DPLRjAV5WGa9UXpyUaxNEXwMim2k3wo/d54t+GTlH9Qigkh/xShKjAOitmfNxXEtvcRZ4rXCQ+Zk/Ie66d+c+qroB5hSCNebUZu1h73RCImU8Okvr1MOOm0qDF3StXV0ES9wgqtYCWNsqelBCpU0ag= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in; spf=pass smtp.mailfrom=cse.iitm.ac.in; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20251104.gappssmtp.com header.i=@cse-iitm-ac-in.20251104.gappssmtp.com header.b=tU0wcZ9M; arc=none smtp.client-ip=209.85.216.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20251104.gappssmtp.com header.i=@cse-iitm-ac-in.20251104.gappssmtp.com header.b="tU0wcZ9M" Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-38e08baf860so618798a91.2 for ; Thu, 23 Jul 2026 05:44:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cse-iitm-ac-in.20251104.gappssmtp.com; s=20251104; t=1784810690; x=1785415490; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=lN+WRJy/Gb9/DDf5BT/PAkv7b2aSSNr6Bp0UfhvwTgY=; b=tU0wcZ9MlmzZTb0tUzlIgVol25l0VBk3VuJH7HtsYs8t2J7xJDU15NJobjCk/NSfqu 05LPKNQoy61y0eTlMOIF9CNXZDGaa9anG1oh8tDvr+FZ9PDBx0cLEBDYk/9j2op9zeQc E2XVodfMFl5oxMKhZtJOT46mStwpzn64WV3HcYz0LdaJ/iJk+YqQ8yLIlRbtmiM/wlRN ROA6qTV7f0r9FzNDWxbQ8V4I1krpO3MAf/LYK2t74Z0CIizuFULxPQn0OiXciL01+c4B AN+JOESBmd31dN049nQvWXH4+92sURc8sF3uijODtk/vz5NZjW8sxCZocjcdMGwczSA6 xOow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784810690; x=1785415490; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=lN+WRJy/Gb9/DDf5BT/PAkv7b2aSSNr6Bp0UfhvwTgY=; b=XceTB84DslxGjbTk6tX1eLv6S8ROHg+W1v4QnbwqMbbtHBR5tj0A/SlzcJBjB4z6Ez TqzBITyTGk/zpO6Zj+fwz3av9yMbgHTZNyt7EPkKcyeNLCguITSgl4IcTVQldelhRzrM sELzkcIIytRpLkJvqLBn8fILl0d+LQA9B2bQqY8LJY2ZhI343GUYtvf0FEx7g/fA+geu HNube+eKQF2+AeWyMzDDaCabPuzavJDa58s8vD8mwJyM/ls5qP5l70hSmIeqvBxe0/dK xkVG7QCgE8oKXUnNOcLDyANbVDm9e4K2wPTE+0SReXu6QHJXkqlH8B4YU+kAAToW46Zf lwmg== X-Forwarded-Encrypted: i=1; AHgh+RpFFzM7lkm+qDJ3PWz2qPWuC+IXDJ/DvTUo+kCVzFd13s5hrAICq4KeqFlTktR+aksn6bWLCCBOqppbdEA=@vger.kernel.org X-Gm-Message-State: AOJu0YyJzbsnYmwGkiNtxG5SH1NoGXMkLpkFZFCpwNmtcO0m1sfmRFid +YjiD36qmY6i+4TTaVHPgXU83egvhTajXx95wfnzCbyAShi21hHPd/Pwfd1DPAlkZ0o= X-Gm-Gg: AR+sD13nR5bgldleihOYZPWQ5seOi5MUSuLmSxVz075u8Ia+FryLjRhFCHNZ4DU/9oj zcjfPujEDzxOrzckLGes8ooaab9PePZhB83o/WCGNtZG6JgplYo14RSirXUbVS5B68enu/ogwT0 Q50wFmi8dlxsJpFm0N4czOjBBgCprEBwqBh656SpZGddH0uyh6BKbZ6iUgwsGgB03AkGNdc8umJ Jp6k6rfqkbancqOQsKOus3bEWl/jwbHB9xbui/OHlfFGQxHQoZUvpfbV8yNG9vSwjSvizUf4HPg FOsuSx6VrPSIFNDOQ6hm1+2eA4VuM61nmx/75SaOUvRa9NsRywbV+ffFINnBqv/HPKufkXiVsHX yl0/dbQVKHLpwpyp92Zuu5EnBNpUeoP7AK0SX8KLuhQ4+CtnuqBYNp7QsTq+Jm2xDBpR3zl6mnB eDAOIXbAeAOnwfrOWPQgpozOacFSzC9Huh7sNlGGSKjjV5TydpJkTyXoP3p4L5RRlEY0lP/q3Lt bmze14WrvcL3DDjU88DsSwz X-Received: by 2002:a17:90b:5603:b0:38e:7eb:d07b with SMTP id 98e67ed59e1d1-38ec6622023mr3288256a91.34.1784810690513; Thu, 23 Jul 2026 05:44:50 -0700 (PDT) Received: from [127.0.1.1] ([103.158.43.43]) by smtp.googlemail.com with ESMTPSA id a92af1059eb24-13d1300401fsm21663197c88.3.2026.07.23.05.44.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 05:44:50 -0700 (PDT) From: Abdun Nihaal Date: Thu, 23 Jul 2026 18:14:16 +0530 Subject: [PATCH v4 2/2] platform/x86: int1092: Fix info leak in parse_package() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260723-platx86-v4-2-93b4a178b595@cse.iitm.ac.in> References: <20260723-platx86-v4-0-93b4a178b595@cse.iitm.ac.in> In-Reply-To: <20260723-platx86-v4-0-93b4a178b595@cse.iitm.ac.in> To: Shravan Sudhakar , Hans de Goede , =?utf-8?q?Ilpo_J=C3=A4rvinen?= Cc: platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Abdun Nihaal , Sashiko X-Mailer: b4 0.13.0 Sashiko reports a possible information leak that can occur as follows: - In parse_package(), memory allocated for data->device_mode_info is not zeroized initially as it is allocated with devm_kmalloc_array() - In the for loop after the allocation, a malformed ACPI package provided by firmware can cause some fields in data->device_mode_info to remain uninitialized - Later in update_sar_data(), the uninitialized fields gets copied to the fields of context->sar_data, which can be exposed to userspace through sysfs attribute read (intc_data_show()) Fix the leak by switching to use devm_kcalloc() for allocation. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260710052806.100107-1-nihaal%40cse= .iitm.ac.in Signed-off-by: Abdun Nihaal --- Newly added in v3 v3->v4: - Updated the commit message with the information leak path as suggested by Ilpo J=C3=A4rvinen. --- drivers/platform/x86/intel/int1092/intel_sar.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/platform/x86/intel/int1092/intel_sar.c b/drivers/platf= orm/x86/intel/int1092/intel_sar.c index 7263114f0b3d..f506155f35d4 100644 --- a/drivers/platform/x86/intel/int1092/intel_sar.c +++ b/drivers/platform/x86/intel/int1092/intel_sar.c @@ -91,10 +91,10 @@ static acpi_status parse_package(struct wwan_sar_contex= t *context, union acpi_ob item->package.count <=3D data->total_dev_mode) return AE_ERROR; =20 - data->device_mode_info =3D devm_kmalloc_array(&context->sar_device->dev, - data->total_dev_mode, - sizeof(*data->device_mode_info), - GFP_KERNEL); + data->device_mode_info =3D devm_kcalloc(&context->sar_device->dev, + data->total_dev_mode, + sizeof(*data->device_mode_info), + GFP_KERNEL); if (!data->device_mode_info) return AE_ERROR; =20 --=20 2.43.0