Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) client-ip=23.128.96.37;
From:   Armin Wolf <W_Armin@gmx.de>
To:     markpearson@lenovo.com, jorge.lopez2@hp.com
Cc:     hdegoede@redhat.com, markgross@kernel.org,
        ilpo.jarvinen@linux.intel.com, platform-driver-x86@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: [PATCH v2 1/2] platform/x86: think-lmi: Fix reference leak
Date:   Mon, 25 Sep 2023 15:25:56 +0200
Message-Id: <20230925132557.72138-2-W_Armin@gmx.de>
In-Reply-To: <20230925132557.72138-1-W_Armin@gmx.de>
References: <20230925132557.72138-1-W_Armin@gmx.de>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:olKkaJhfIwc=;oa51/MpZQBVGURUzVJ8ACTj9OH8
 VWyPJ21gjdF6ZFd9RNfUdY4JnzA0TiKUAsNZbt4F7kbESFSqe7P1q8kO6RiHzlnsNsMYW3lI6
 RVOEhc06QaeY/BLoi6ux0cBaQvaomXZkwVecDTt5+HR2l/+GWMSS5IDqglLOCZI/w3dqsZiLX
 d02WH+kCqlWVWF3ZhBFIhXZSKUafI+klipjrY96TpqKIpVeWjPgAMkSuUl2Y+3noTUT5TJ8A/
 6ZF2/jvRe2lWnAklwrfG0UEnyu1VLQmT9KnsJJkkfaGt19QVK0jNsUZ7kEllvof1jLET7haFE
 uPre5pfkW/B0Ue1D+1STIB1SDwG+Z8K5rcnL1w1lrL3n93zZNrUm5h6oa7HNKJlUxCav6OOTd
 sfmAQWdYH2YoXS7TdEgX8e9kF30FgGjshkfP3mvDKSkwqmXrZW00qFNkscxjMijzdoQB9/Tpe
 mZtSMKSr/2/Plc/7K1n/LVqKI2hvt0tClszPwWCDtUnmB8FBbiTd+5kNSnfv5IQuUUVQ9Qu6G
 NF2SMpwMNUi07cn6B73HUE+scWh21tppUgmd8HSrWAmIWAncbMvLi2Ol/tM18j+Nw6c61+txu
 73P35Qyq+zxfXu5jsw1X1VzkyByWU7wPYkWINBGKTJOGSE4VGFhrdVWMRD0wBTTAMr0rguvIf
 ctewVpR16DFjMvxZvKdNWDszCdgbqWT7qi0k8ndFES0ULAlRz1X+a3lP9bRIvuR/nnBeTYNtr
 99j3cWWQS3HMhp8K0umoTazM5we/sg3c4SCBrTc43BY05+FwbTcvf0EFO2kln8k468d+O1fQ2
 7gFNj9CwrkkoCL5eZKsCl04u5Lqyv+QQsZ0Tij+SyuyuhTrp4YS4suAUe0cuddEXTjt8S9kbN
 G6d/ZMeMdIDG4dJTSPr4XGJj4Bjt1fAH9lasfJaHTeBUNOD0WdjhOwH++GQRxjVXqb4cVxARk
 vEQpuQ==
Precedence: bulk

If a duplicate attribute is found using kset_find_obj(), a reference
to that attribute is returned which needs to be disposed accordingly
using kobject_put(). Move the setting name validation into a separate
function to allow for this change without having to duplicate the
cleanup code for this setting.
As a side note, a very similar bug was fixed in
commit 7295a996fdab ("platform/x86: dell-sysman: Fix reference leak"),
so it seems that the bug was copied from that driver.

Compile-tested only.

Fixes: 1bcad8e510b2 ("platform/x86: think-lmi: Fix issues with duplicate a=
ttributes")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
=2D--
Changes in v2:
- no changes
=2D--
 drivers/platform/x86/think-lmi.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think=
-lmi.c
index 4be6f28d4600..3a396b763c49 100644
=2D-- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -1344,6 +1344,24 @@ static void tlmi_release_attr(void)
 	kset_unregister(tlmi_priv.authentication_kset);
 }

+static int tlmi_validate_setting_name(struct kset *attribute_kset, char *=
name)
+{
+	struct kobject *duplicate;
+
+	if (!strcmp(name, "Reserved"))
+		return -EINVAL;
+
+	duplicate =3D kset_find_obj(attribute_kset, name);
+	if (duplicate) {
+		pr_debug("Duplicate attribute name found - %s\n", name);
+		/* kset_find_obj() returns a reference */
+		kobject_put(duplicate);
+		return -EBUSY;
+	}
+
+	return 0;
+}
+
 static int tlmi_sysfs_init(void)
 {
 	int i, ret;
@@ -1372,10 +1390,8 @@ static int tlmi_sysfs_init(void)
 			continue;

 		/* check for duplicate or reserved values */
-		if (kset_find_obj(tlmi_priv.attribute_kset, tlmi_priv.setting[i]->displ=
ay_name) ||
-		    !strcmp(tlmi_priv.setting[i]->display_name, "Reserved")) {
-			pr_debug("duplicate or reserved attribute name found - %s\n",
-				tlmi_priv.setting[i]->display_name);
+		if (tlmi_validate_setting_name(tlmi_priv.attribute_kset,
+					       tlmi_priv.setting[i]->display_name) < 0) {
 			kfree(tlmi_priv.setting[i]->possible_values);
 			kfree(tlmi_priv.setting[i]);
 			tlmi_priv.setting[i] =3D NULL;
=2D-
2.39.2