[PATCH] board: nxp: fix memory leak and check calloc in ft_board_setup

[PATCH] board: nxp: fix memory leak and check calloc in ft_board_setup

[Yuho Choi]

In ft_board_setup() for NXP Layerscape platforms (LS1088A, LS2080A,
and LX2160A), base and size arrays are allocated via calloc() to pass
DRAM bank parameters to fdt_fixup_memory_banks().

On LS2080A and LX2160A, the return values of calloc() are not checked
for NULL, which can cause a NULL pointer dereference if allocation fails.
Furthermore, on all three platforms, base and size are never freed after
fdt_fixup_memory_banks() only consumes these arrays during the call and
does not retain them. However, neither array is freed after the call,
leaking memory regardless of whether the FDT update succeeds.

Fix these issues by validating the calloc() return values where missing
and freeing both base and size after fdt_fixup_memory_banks().

Fixes: cf0bbbd1ee7b ("drivers: net: mc: Report extra memory to Linux")
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
 board/nxp/ls1088a/ls1088a.c       |  3 +++
 board/nxp/ls2080ardb/ls2080ardb.c | 11 +++++++++++
 board/nxp/lx2160a/lx2160a.c       | 11 +++++++++++
 3 files changed, 25 insertions(+)

diff --git a/board/nxp/ls1088a/ls1088a.c b/board/nxp/ls1088a/ls1088a.c
index 8ea76fe3760..29598cd487b 100644
--- a/board/nxp/ls1088a/ls1088a.c
+++ b/board/nxp/ls1088a/ls1088a.c
@@ -986,6 +986,9 @@ int ft_board_setup(void *blob, struct bd_info *bd)
 
 	fdt_fixup_memory_banks(blob, base, size, total_memory_banks);
 
+	free(base);
+	free(size);
+
 	fdt_fsl_mc_fixup_iommu_map_entry(blob);
 
 	fsl_fdt_fixup_flash(blob);
diff --git a/board/nxp/ls2080ardb/ls2080ardb.c b/board/nxp/ls2080ardb/ls2080ardb.c
index 9dec818280b..d9f23b72fa0 100644
--- a/board/nxp/ls2080ardb/ls2080ardb.c
+++ b/board/nxp/ls2080ardb/ls2080ardb.c
@@ -484,7 +484,14 @@ int ft_board_setup(void *blob, struct bd_info *bd)
 	total_memory_banks = CONFIG_NR_DRAM_BANKS + mc_memory_bank;
 
 	base = calloc(total_memory_banks, sizeof(u64));
+	if (!base)
+		return -ENOMEM;
+
 	size = calloc(total_memory_banks, sizeof(u64));
+	if (!size) {
+		free(base);
+		return -ENOMEM;
+	}
 
 	/* fixup DT for the two GPP DDR banks */
 	base[0] = gd->dram[0].start;
@@ -514,6 +521,9 @@ int ft_board_setup(void *blob, struct bd_info *bd)
 
 	fdt_fixup_memory_banks(blob, base, size, total_memory_banks);
 
+	free(base);
+	free(size);
+
 	fdt_fsl_mc_fixup_iommu_map_entry(blob);
 
 	fsl_fdt_fixup_dr_usb(blob, bd);
diff --git a/board/nxp/lx2160a/lx2160a.c b/board/nxp/lx2160a/lx2160a.c
index 10729dfaf24..330d720e9bc 100644
--- a/board/nxp/lx2160a/lx2160a.c
+++ b/board/nxp/lx2160a/lx2160a.c
@@ -804,7 +804,14 @@ int ft_board_setup(void *blob, struct bd_info *bd)
 	total_memory_banks = CONFIG_NR_DRAM_BANKS + mc_memory_bank;
 
 	base = calloc(total_memory_banks, sizeof(u64));
+	if (!base)
+		return -ENOMEM;
+
 	size = calloc(total_memory_banks, sizeof(u64));
+	if (!size) {
+		free(base);
+		return -ENOMEM;
+	}
 
 	/* fixup DT for the three GPP DDR banks */
 	for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
@@ -837,6 +844,9 @@ int ft_board_setup(void *blob, struct bd_info *bd)
 
 	fdt_fixup_memory_banks(blob, base, size, total_memory_banks);
 
+	free(base);
+	free(size);
+
 #ifdef CONFIG_USB_HOST
 	fsl_fdt_fixup_dr_usb(blob, bd);
 #endif
-- 
2.43.0