[PATCH] platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()

[PATCH] platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()

[Yu Liao]

The ACPI buffer memory (out.pointer) returned by wmi_evaluate_method()
is not freed after the call, so it leads to memory leak.

The method results in ACPI buffer is not used, so just pass NULL to
wmi_evaluate_method() which fixes the memory leak.

Fixes: 99b38b4acc0d ("platform/x86: add MXM WMI driver.")
Signed-off-by: Yu Liao <liaoyu15@huawei.com>
---
 drivers/platform/x86/mxm-wmi.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/platform/x86/mxm-wmi.c b/drivers/platform/x86/mxm-wmi.c
index 9a19fbd2f734..9a457956025a 100644
--- a/drivers/platform/x86/mxm-wmi.c
+++ b/drivers/platform/x86/mxm-wmi.c
@@ -35,13 +35,11 @@ int mxm_wmi_call_mxds(int adapter)
 		.xarg = 1,
 	};
 	struct acpi_buffer input = { (acpi_size)sizeof(args), &args };
-	struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
 	acpi_status status;
 
 	printk("calling mux switch %d\n", adapter);
 
-	status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input,
-				     &output);
+	status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input, NULL);
 
 	if (ACPI_FAILURE(status))
 		return status;
@@ -60,13 +58,11 @@ int mxm_wmi_call_mxmx(int adapter)
 		.xarg = 1,
 	};
 	struct acpi_buffer input = { (acpi_size)sizeof(args), &args };
-	struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
 	acpi_status status;
 
 	printk("calling mux switch %d\n", adapter);
 
-	status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input,
-				     &output);
+	status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input, NULL);
 
 	if (ACPI_FAILURE(status))
 		return status;
-- 
2.25.1

Re: [PATCH] platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()

[Hans de Goede]

Hi,

On 11/29/22 02:11, Yu Liao wrote:
> The ACPI buffer memory (out.pointer) returned by wmi_evaluate_method()
> is not freed after the call, so it leads to memory leak.
> 
> The method results in ACPI buffer is not used, so just pass NULL to
> wmi_evaluate_method() which fixes the memory leak.
> 
> Fixes: 99b38b4acc0d ("platform/x86: add MXM WMI driver.")
> Signed-off-by: Yu Liao <liaoyu15@huawei.com>

Thank you for your patch, I've applied this patch to my review-hans 
branch:
https://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86.git/log/?h=review-hans

Note it will show up in my review-hans branch once I've pushed my
local branch there, which might take a while.

Once I've run some tests on this branch the patches there will be
added to the platform-drivers-x86/for-next branch and eventually
will be included in the pdx86 pull-request to Linus for the next
merge-window.

Regards,

Hans



> ---
>  drivers/platform/x86/mxm-wmi.c | 8 ++------
>  1 file changed, 2 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/platform/x86/mxm-wmi.c b/drivers/platform/x86/mxm-wmi.c
> index 9a19fbd2f734..9a457956025a 100644
> --- a/drivers/platform/x86/mxm-wmi.c
> +++ b/drivers/platform/x86/mxm-wmi.c
> @@ -35,13 +35,11 @@ int mxm_wmi_call_mxds(int adapter)
>  		.xarg = 1,
>  	};
>  	struct acpi_buffer input = { (acpi_size)sizeof(args), &args };
> -	struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
>  	acpi_status status;
>  
>  	printk("calling mux switch %d\n", adapter);
>  
> -	status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input,
> -				     &output);
> +	status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input, NULL);
>  
>  	if (ACPI_FAILURE(status))
>  		return status;
> @@ -60,13 +58,11 @@ int mxm_wmi_call_mxmx(int adapter)
>  		.xarg = 1,
>  	};
>  	struct acpi_buffer input = { (acpi_size)sizeof(args), &args };
> -	struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
>  	acpi_status status;
>  
>  	printk("calling mux switch %d\n", adapter);
>  
> -	status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input,
> -				     &output);
> +	status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input, NULL);
>  
>  	if (ACPI_FAILURE(status))
>  		return status;