[PATCH v1 0/2] platform/x86: Fixes for leaks in panasonic-laptop and toshiba-haps drivers

[PATCH v1 0/2] platform/x86: Fixes for leaks in panasonic-laptop and toshiba-haps drivers

[Rafael J. Wysocki]

Hi All,

These are two fixes for leaks in the panasonic-laptop and toshiba-haps drivers,
in the "probe error" and "remove" paths.

Thanks!

[PATCH v1 1/2] platform/x86: panasonic-laptop: Fix sysfs group leak in error path

[Rafael J. Wysocki]

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group
if platform_device_register_simple() fails for the "panasonic" platform
device.

Address this by making it call sysfs_remove_group() in that case for
the group in question.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
---
 drivers/platform/x86/panasonic-laptop.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/platform/x86/panasonic-laptop.c
+++ b/drivers/platform/x86/panasonic-laptop.c
@@ -1089,7 +1089,7 @@ static int acpi_pcc_hotkey_add(struct ac
 			PLATFORM_DEVID_NONE, NULL, 0);
 		if (IS_ERR(pcc->platform)) {
 			result = PTR_ERR(pcc->platform);
-			goto out_backlight;
+			goto out_sysfs;
 		}
 		result = device_create_file(&pcc->platform->dev,
 			&dev_attr_cdpower);
@@ -1105,6 +1105,8 @@ static int acpi_pcc_hotkey_add(struct ac
 
 out_platform:
 	platform_device_unregister(pcc->platform);
+out_sysfs:
+	sysfs_remove_group(&device->dev.kobj, &pcc_attr_group);
 out_backlight:
 	backlight_device_unregister(pcc->backlight);
 out_input:

[PATCH v1 2/2] platform/x86: toshiba_haps: Fix memory leaks in add/remove routines

[Rafael J. Wysocki]

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

toshiba_haps_add() leaks the haps object allocated by it if it returns
an error after allocating that object successfully.

toshiba_haps_remove() does not free the object pointed to by
toshiba_haps before clearing that pointer, so it becomes unreachable
allocated memory.

Address these memory leaks by freeing the memory in question as
appropriate.

Fixes: 23d0ba0c908a ("platform/x86: Toshiba HDD Active Protection Sensor")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
---
 drivers/platform/x86/toshiba_haps.c |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

--- a/drivers/platform/x86/toshiba_haps.c
+++ b/drivers/platform/x86/toshiba_haps.c
@@ -142,8 +142,8 @@ static void toshiba_haps_remove(struct a
 {
 	sysfs_remove_group(&device->dev.kobj, &haps_attr_group);
 
-	if (toshiba_haps)
-		toshiba_haps = NULL;
+	kfree(toshiba_haps);
+	toshiba_haps = NULL;
 }
 
 /* Helper function */
@@ -195,15 +195,20 @@ static int toshiba_haps_add(struct acpi_
 	/* Set the protection level, currently at level 2 (Medium) */
 	ret = toshiba_haps_protection_level(acpi_dev->handle, 2);
 	if (ret != 0)
-		return ret;
+		goto err;
 
 	ret = sysfs_create_group(&acpi_dev->dev.kobj, &haps_attr_group);
 	if (ret)
-		return ret;
+		goto err;
 
 	toshiba_haps = haps;
 
 	return 0;
+
+err:
+	kfree(haps);
+
+	return ret;
 }
 
 #ifdef CONFIG_PM_SLEEP

[PATCH v2 2/2] platform/x86: toshiba_haps: Fix memory leaks in add/remove routines

[Rafael J. Wysocki]

On Tuesday, January 20, 2026 4:44:23 PM CET Rafael J. Wysocki wrote:
> From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> 
> toshiba_haps_add() leaks the haps object allocated by it if it returns
> an error after allocating that object successfully.
> 
> toshiba_haps_remove() does not free the object pointed to by
> toshiba_haps before clearing that pointer, so it becomes unreachable
> allocated memory.
> 
> Address these memory leaks by freeing the memory in question as
> appropriate.

Actually, this one can use devm_kzalloc() for allocating memory instead,
so here's a v2.

---
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Subject: [PATCH v2 2/2] platform/x86: toshiba_haps: Fix memory leaks in add/remove routines

toshiba_haps_add() leaks the haps object allocated by it if it returns
an error after allocating that object successfully.

toshiba_haps_remove() does not free the object pointed to by
toshiba_haps before clearing that pointer, so it becomes unreachable
allocated memory.

Address these memory leaks by using devm_kzalloc() for allocating
the memory in question.

Fixes: 23d0ba0c908a ("platform/x86: Toshiba HDD Active Protection Sensor")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
---

v1 -> v2:
   * Use devm_kzalloc() for memory allocation and drop the rest of the changes.

---
 drivers/platform/x86/toshiba_haps.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/platform/x86/toshiba_haps.c
+++ b/drivers/platform/x86/toshiba_haps.c
@@ -183,7 +183,7 @@ static int toshiba_haps_add(struct acpi_
 
 	pr_info("Toshiba HDD Active Protection Sensor device\n");
 
-	haps = kzalloc(sizeof(struct toshiba_haps_dev), GFP_KERNEL);
+	haps = devm_kzalloc(&acpi_dev->dev, sizeof(*haps), GFP_KERNEL);
 	if (!haps)
 		return -ENOMEM;
 

Re: [PATCH v1 0/2] platform/x86: Fixes for leaks in panasonic-laptop and toshiba-haps drivers

[Ilpo Järvinen]

On Tue, 20 Jan 2026 16:42:41 +0100, Rafael J. Wysocki wrote:

> These are two fixes for leaks in the panasonic-laptop and toshiba-haps drivers,
> in the "probe error" and "remove" paths.
> 
> Thanks!
> 


Thank you for your contribution, it has been applied to my local
review-ilpo-fixes branch. Note it will show up in the public
platform-drivers-x86/review-ilpo-fixes branch only once I've pushed my
local branch there, which might take a while.

The list of commits applied:
[1/2] platform/x86: panasonic-laptop: Fix sysfs group leak in error path
      commit: 43b0b7eff4b3fb684f257d5a24376782e9663465
[2/2] platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
      commit: 128497456756e1b952bd5a912cd073836465109d

--
 i.

Re: [PATCH v1 0/2] platform/x86: Fixes for leaks in panasonic-laptop and toshiba-haps drivers

[Rafael J. Wysocki]

On Mon, Jan 26, 2026 at 3:56 PM Ilpo Järvinen
<ilpo.jarvinen@linux.intel.com> wrote:
>
> On Tue, 20 Jan 2026 16:42:41 +0100, Rafael J. Wysocki wrote:
>
> > These are two fixes for leaks in the panasonic-laptop and toshiba-haps drivers,
> > in the "probe error" and "remove" paths.
> >
> > Thanks!
> >
>
>
> Thank you for your contribution, it has been applied to my local
> review-ilpo-fixes branch. Note it will show up in the public
> platform-drivers-x86/review-ilpo-fixes branch only once I've pushed my
> local branch there, which might take a while.
>
> The list of commits applied:
> [1/2] platform/x86: panasonic-laptop: Fix sysfs group leak in error path
>       commit: 43b0b7eff4b3fb684f257d5a24376782e9663465
> [2/2] platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
>       commit: 128497456756e1b952bd5a912cd073836465109d

Thanks!

Just to confirm, I sent a v2 of the second patch in the meantime:

https://lore.kernel.org/linux-acpi/12823935.O9o76ZdvQC@rafael.j.wysocki/

I gather that this is what you have applied.  In any case, it is a
replacement for the v1.

Re: [PATCH v1 0/2] platform/x86: Fixes for leaks in panasonic-laptop and toshiba-haps drivers

[Ilpo Järvinen]

[-- Attachment #1: Type: text/plain, Size: 1513 bytes --]

On Mon, 26 Jan 2026, Rafael J. Wysocki wrote:
> On Mon, Jan 26, 2026 at 3:56 PM Ilpo Järvinen
> <ilpo.jarvinen@linux.intel.com> wrote:
> >
> > On Tue, 20 Jan 2026 16:42:41 +0100, Rafael J. Wysocki wrote:
> >
> > > These are two fixes for leaks in the panasonic-laptop and toshiba-haps drivers,
> > > in the "probe error" and "remove" paths.
> > >
> > > Thanks!
> > >
> >
> >
> > Thank you for your contribution, it has been applied to my local
> > review-ilpo-fixes branch. Note it will show up in the public
> > platform-drivers-x86/review-ilpo-fixes branch only once I've pushed my
> > local branch there, which might take a while.
> >
> > The list of commits applied:
> > [1/2] platform/x86: panasonic-laptop: Fix sysfs group leak in error path
> >       commit: 43b0b7eff4b3fb684f257d5a24376782e9663465
> > [2/2] platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
> >       commit: 128497456756e1b952bd5a912cd073836465109d
> 
> Thanks!
> 
> Just to confirm, I sent a v2 of the second patch in the meantime:
> 
> https://lore.kernel.org/linux-acpi/12823935.O9o76ZdvQC@rafael.j.wysocki/
> 
> I gather that this is what you have applied.  In any case, it is a
> replacement for the v1.

Yes, I used the devm_ variant of patch 2 (v2). ...Had to jump through 
a few hoops though to get b4 to apply things correctly, and this is what 
you get as a confirmation/thankyou email if you don't refresh the whole 
series but just a single patch in it.

-- 
 i.

Re: [PATCH v1 0/2] platform/x86: Fixes for leaks in panasonic-laptop and toshiba-haps drivers

[Rafael J. Wysocki]

On Tue, Jan 27, 2026 at 12:04 PM Ilpo Järvinen
<ilpo.jarvinen@linux.intel.com> wrote:
>
> On Mon, 26 Jan 2026, Rafael J. Wysocki wrote:
> > On Mon, Jan 26, 2026 at 3:56 PM Ilpo Järvinen
> > <ilpo.jarvinen@linux.intel.com> wrote:
> > >
> > > On Tue, 20 Jan 2026 16:42:41 +0100, Rafael J. Wysocki wrote:
> > >
> > > > These are two fixes for leaks in the panasonic-laptop and toshiba-haps drivers,
> > > > in the "probe error" and "remove" paths.
> > > >
> > > > Thanks!
> > > >
> > >
> > >
> > > Thank you for your contribution, it has been applied to my local
> > > review-ilpo-fixes branch. Note it will show up in the public
> > > platform-drivers-x86/review-ilpo-fixes branch only once I've pushed my
> > > local branch there, which might take a while.
> > >
> > > The list of commits applied:
> > > [1/2] platform/x86: panasonic-laptop: Fix sysfs group leak in error path
> > >       commit: 43b0b7eff4b3fb684f257d5a24376782e9663465
> > > [2/2] platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
> > >       commit: 128497456756e1b952bd5a912cd073836465109d
> >
> > Thanks!
> >
> > Just to confirm, I sent a v2 of the second patch in the meantime:
> >
> > https://lore.kernel.org/linux-acpi/12823935.O9o76ZdvQC@rafael.j.wysocki/
> >
> > I gather that this is what you have applied.  In any case, it is a
> > replacement for the v1.
>
> Yes, I used the devm_ variant of patch 2 (v2). ...Had to jump through
> a few hoops though to get b4 to apply things correctly, and this is what
> you get as a confirmation/thankyou email if you don't refresh the whole
> series but just a single patch in it.

OK, thanks!