From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7592957EDA8 for ; Wed, 9 Sep 2026 14:50:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788965437; cv=none; b=rkPmie4cLvcAwXsCjcMMRg2p0xUBcU8wCcbqzsB5mZMvGySNAaNxGfyK+G+0MZ0+iiWGsajGUXqhc1Jx5hzZt9BydZRNUVNI4UmofCH39piVa/PBJO6K2pz9R1YsKTKmJNltMtEAdShwsyH9xYAKdZEWwIqboIab40ytYW8yldk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788965437; c=relaxed/simple; bh=iH7ONmsnFzLXoNPk9MtIToQH9U6od6kKo5EtPyQIXNk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Lm57A+49pD+R+9PhY/wbrbbSri70wEaqknI4uZVzxqXTD9rB8e48Ci4uqoGUOfsHoSWuSXGbTGUVorlk9Dzs9Ec4Sozk4JUPBHUxzJRLg70wsdZ/eBEu2KLgUoeaVmi1cbqhs410ffaUUOL1bE91cTZyXJVuqoQQK92MrQZNjjk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=oLuDrfma; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="oLuDrfma" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DBF111F00ACA; Wed, 9 Sep 2026 14:50:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788965435; bh=bh9lddhSedU9QER6SezOdR5LR7F8Efpo5ALT/5U5SYU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=oLuDrfmaz9TzFHAZKwoxnd/LjulLcuiOcJcBJYq+D7IGjeJeGHnJld8Pb6wBx2E8n GCSYyBQ9sAYd1cvh7p8vcytcbcumfk7dq6dnOvEdqO0IJfxWh2YTMMvIz8BCIpNnit 1AkJTKFTXjWrIKDiBtLO/GkTIL1JRX7SGaOZKs0SB6SX1gyZWbhp2sn4NyzOA/dg2f THEwGu2BA+1kElf+tPD2wXe6zNfWxxJajAZAgXymrIb6V1gxuOOLZ/LeE9zsIncx6V xyFMJsTy/+eGQS1vxB4oIn9rbIMo+boveo1zBvZQCJwB9DdpqVc3E617cypm0N8D5e qB3kWmDOl+mVg== From: Sasha Levin To: stable@vger.kernel.org Cc: Abdun Nihaal , =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= , Sasha Levin Subject: [PATCH 6.18.y 2/2] platform/x86: int1092: Fix potential memory leak in sar_probe() Date: Wed, 9 Sep 2026 10:50:32 -0400 Message-ID: <20260909145032.2673759-2-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260909145032.2673759-1-sashal@kernel.org> References: <2026090357-antennae-prong-732d@gregkh> <20260909145032.2673759-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Abdun Nihaal [ Upstream commit 30c906cff490c3601ee9ff110fe8115fabe75fd4 ] The memory allocated for device_mode_info in parse_package() called by sar_get_data() is not freed in some of the error paths in sar_probe(). Fix that by converting to use device managed allocations. Fixes: dcfbd31ef4bc ("platform/x86: BIOS SAR driver for Intel M.2 Modem") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20260723-platx86-v4-1-93b4a178b595@cse.iitm.ac.in Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen Signed-off-by: Sasha Levin --- .../platform/x86/intel/int1092/intel_sar.c | 32 ++++++------------- 1 file changed, 10 insertions(+), 22 deletions(-) diff --git a/drivers/platform/x86/intel/int1092/intel_sar.c b/drivers/platform/x86/intel/int1092/intel_sar.c index 849f7b415c1e5..7263114f0b3d0 100644 --- a/drivers/platform/x86/intel/int1092/intel_sar.c +++ b/drivers/platform/x86/intel/int1092/intel_sar.c @@ -91,8 +91,10 @@ static acpi_status parse_package(struct wwan_sar_context *context, union acpi_ob item->package.count <= data->total_dev_mode) return AE_ERROR; - data->device_mode_info = kmalloc_objs(struct wwan_device_mode_info, - data->total_dev_mode); + data->device_mode_info = devm_kmalloc_array(&context->sar_device->dev, + data->total_dev_mode, + sizeof(*data->device_mode_info), + GFP_KERNEL); if (!data->device_mode_info) return AE_ERROR; @@ -253,7 +255,7 @@ static int sar_probe(struct platform_device *device) if (!handle) return -ENODEV; - context = kzalloc_obj(*context); + context = devm_kzalloc(&device->dev, sizeof(*context), GFP_KERNEL); if (!context) return -ENOMEM; @@ -264,7 +266,7 @@ static int sar_probe(struct platform_device *device) result = guid_parse(SAR_DSM_UUID, &context->guid); if (result) { dev_err(&device->dev, "SAR UUID parse error: %d\n", result); - goto r_free; + return result; } for (reg = 0; reg < MAX_REGULATORY; reg++) @@ -272,43 +274,29 @@ static int sar_probe(struct platform_device *device) if (sar_get_device_mode(device) != AE_OK) { dev_err(&device->dev, "Failed to get device mode\n"); - result = -EIO; - goto r_free; + return -EIO; } result = sysfs_create_group(&device->dev.kobj, &intcsar_group); if (result) { dev_err(&device->dev, "sysfs creation failed\n"); - goto r_free; + return result; } if (acpi_install_notify_handler(ACPI_HANDLE(&device->dev), ACPI_DEVICE_NOTIFY, sar_notify, (void *)device) != AE_OK) { dev_err(&device->dev, "Failed acpi_install_notify_handler\n"); - result = -EIO; - goto r_sys; + sysfs_remove_group(&device->dev.kobj, &intcsar_group); + return -EIO; } return 0; - -r_sys: - sysfs_remove_group(&device->dev.kobj, &intcsar_group); -r_free: - kfree(context); - return result; } static void sar_remove(struct platform_device *device) { - struct wwan_sar_context *context = dev_get_drvdata(&device->dev); - int reg; - acpi_remove_notify_handler(ACPI_HANDLE(&device->dev), ACPI_DEVICE_NOTIFY, sar_notify); sysfs_remove_group(&device->dev.kobj, &intcsar_group); - for (reg = 0; reg < MAX_REGULATORY; reg++) - kfree(context->config_data[reg].device_mode_info); - - kfree(context); } static struct platform_driver sar_driver = { -- 2.53.0