Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Armin Wolf <W_Armin@gmx.de>
To:     markpearson@lenovo.com, mirsad.todorovac@alu.unizg.hr
Cc:     hdegoede@redhat.com, markgross@kernel.org, thomas@t-8ch.de,
        gregkh@linuxfoundation.org, rafael@kernel.org,
        platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH v3] platform/x86: think-lmi: Fix memory leak when showing current settings
Date:   Fri, 31 Mar 2023 23:33:19 +0200
Message-Id: <20230331213319.41040-1-W_Armin@gmx.de>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:3yD1piXwDKw=;Ee56+PiU5hMw9gDLK0SwwwcJZGx
 h3U8PXO4P5txxb+W1ze0xn0mfHxo131dYWZc7NsFi0IlzZX52frWKcotbQbn9UkXUPSbt/mz6
 Xnj/6tKhV/4NW8sxGV/AMfKFrsPPWN4m+JIFwMtQGK5HhHv2L1GqGX/QzQA0/jGn1OwDBIAMQ
 +lg/u5qdRR4ZwaNrFeMS9vqTIxMl3AxarmsIurQM9L07TiQhZmZSlnctpIkWJsDZALxSJSEBv
 aw0jfIHmiFOPOZKXIvVeSj6olZeIkajBCYZNfIsNM4rTVweP5xbynNF+Exerl/zDbtalAtd/A
 xVlDrvwMUYUoX9mzjnyx+IGCjmC1U4wxuC0ADErYomLx4tJuLEAyWxQXPauKb79NUlE9KueFr
 iI0es9zUy8ANM8MZoHJsxlkN/lNJQnS0Z8CMdRvg4qay0djYv94UkxqBWQOFBsKQpfXAg+xFV
 Y9jj5nr1wqvYUuh8i8CJ17YauDHYfElSa3xljzKwS229UhCuszQFB2RIcPBjtO46ZhPQsST9+
 1+Zya9V5AdHvP2N/399edPHocke8NMMAHMP+/mmQ+R5y4z+hOOj3zIfDbk7MKC4e322P9FFHI
 uLny7qDCwe2EZU5JSUPR2WtnIa0Hj6Ysl/KIbbQLtpOZa/RjRg5Sp5Ya0UoF4cCHugWFx+HkX
 vn+QUSau5qrYGp4bRyLlXNxdJpflj1p/1vEcp9VvGRB3SB8G6WK85kzVun6DYeWkrXchqe/+b
 w5TvT9+v//FNPdfPcU43GHgpTTeV2/itTEntFwr96HXFtPsUtiat5lRvMJXqeO0ETN1kCi+0Y
 wm6KC8Q3iF7FcnJd2rVCbaZeyXe1CIBUp3mT83nA8to4HSt3YLP/Fs9YQLtNzpMfd30R9mE4Y
 +YJs2bRrLtW7y4Hlkd2Z2A+1cUw77pdKY1iEVEzIpqZCkYnoIb3FxRPFZNXeCtzzItydZlLEx
 /MVuhHtd2JpYXz4Wm7mSvo8XmMM=
Precedence: bulk

When retriving a item string with tlmi_setting(), the result has to be
freed using kfree(). In current_value_show() however, malformed
item strings are not freed, causing a memory leak.
Fix this by eliminating the early return responsible for this.

Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Link: https://lore.kernel.org/platform-driver-x86/01e920bc-5882-ba0c-dd15-=
868bf0eca0b8@alu.unizg.hr/T/#t
Tested-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Fixes: 0fdf10e5fc96 ("platform/x86: think-lmi: Split current_value to refl=
ect only the value")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
=2D--
Changes in v3:
- Fix Fixes: tag
- Add Tested-by: tag
Changes in v2:
- Add Reported-by: and Link: tags
=2D--
 drivers/platform/x86/think-lmi.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think=
-lmi.c
index cc66f7cbccf2..8cafb9d4016c 100644
=2D-- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -930,10 +930,12 @@ static ssize_t current_value_show(struct kobject *ko=
bj, struct kobj_attribute *a
 	/* validate and split from `item,value` -> `value` */
 	value =3D strpbrk(item, ",");
 	if (!value || value =3D=3D item || !strlen(value + 1))
-		return -EINVAL;
+		ret =3D -EINVAL;
+	else
+		ret =3D sysfs_emit(buf, "%s\n", value + 1);

-	ret =3D sysfs_emit(buf, "%s\n", value + 1);
 	kfree(item);
+
 	return ret;
 }

=2D-
2.30.2