Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
DMARC-Filter: OpenDMARC Filter v1.3.2 mta-p6.oit.umn.edu 49knbM6Wmfz9vJyx
From:   wu000273@umn.edu
To:     kjlu@umn.edu
Cc:     wu000273@umn.edu, linux-kernel@vger.kernel.org
Subject: [PATCH] firmware: dmi: Fix reference count leaks.
Date:   Sat, 13 Jun 2020 14:24:23 -0500
Message-Id: <20200613192424.19884-1-wu000273@umn.edu>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

From: Qiushi Wu <wu000273@umn.edu>

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.
Callback function dmi_sysfs_entry_release() in kobject_put()
can handle the pointer "entry" properly.

Signed-off-by: Qiushi Wu <wu000273@umn.edu>
---
 drivers/firmware/dmi-sysfs.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c
index b6180023eba7..9889e5ed2064 100644
--- a/drivers/firmware/dmi-sysfs.c
+++ b/drivers/firmware/dmi-sysfs.c
@@ -457,8 +457,10 @@ static int dmi_system_event_log(struct dmi_sysfs_entry *entry)
 				   &dmi_system_event_log_ktype,
 				   &entry->kobj,
 				   "system_event_log");
-	if (ret)
-		goto out_free;
+	if (ret) {
+		kobject_put(entry->child);
+		return ret;
+	}
 
 	ret = sysfs_create_bin_file(entry->child, &dmi_sel_raw_attr);
 	if (ret)
@@ -468,7 +470,6 @@ static int dmi_system_event_log(struct dmi_sysfs_entry *entry)
 
 out_del:
 	kobject_del(entry->child);
-out_free:
 	kfree(entry->child);
 	return ret;
 }
@@ -603,7 +604,7 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh,
 				    "%d-%d", dh->type, entry->instance);
 
 	if (*ret) {
-		kfree(entry);
+		kobject_put(&entry->kobj);
 		return;
 	}
 
-- 
2.17.1