Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.34 as permitted sender) client-ip=23.128.96.34;
From:   Armin Wolf <W_Armin@gmx.de>
To:     markpearson@lenovo.com, jorge.lopez2@hp.com
Cc:     hdegoede@redhat.com, markgross@kernel.org,
        ilpo.jarvinen@linux.intel.com, platform-driver-x86@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: [PATCH v3 1/2] platform/x86: think-lmi: Fix reference leak
Date:   Mon, 25 Sep 2023 15:28:43 +0200
Message-Id: <20230925132844.72479-2-W_Armin@gmx.de>
In-Reply-To: <20230925132844.72479-1-W_Armin@gmx.de>
References: <20230925132844.72479-1-W_Armin@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:ZUToJMOjej4=;whp+qgCHvgDB5g9yWRRyqv4536Z
 Lh5m2+vMP0w4w/tT4gTNohXUPoRm92tZsKx47ZtafcqaLAdB/+9ruOls/vuhQ/pLxKRi4lSdz
 iLn1JIoxYxLgE79Ue1TjkJFyINxBJJAYxLmmGfQZl42Mr5CIlz2teJSiQt46GgdNqeFZChym7
 ORXwWkqg9LZhX/NMP+tFSG6bI5ws45vwMygW/ThIFN4K9lH42ysxDSmaac7eR52ty1QxpMlTq
 xLkyjiyUuzY58tpRsFCvBrnBiY9C1G2PiqNPz9hs7Dvtyel4OmzhvrYZuVvqZtXDubPXPQ3VQ
 5LALlYBDDLCiT1UN5RdzeZwoqHx5JklUH1uL+rNJmqvaV3H0NIifv4Xu0iBY57CfePU+AkDI+
 U4f99lojc8Ez4dBxPyahIOVTJnaPM5laOfkEHBjOlR75yOsyjZgcMaSHYbfeJkbGJ4fEAnHFA
 xFzsAzBXg92Lr5isjaj+sS7NJj0WfPl2aK+H2vxZxa2jWvS6aWUK4sjY5e9VkUip+90hP9Gre
 0xGVgM8Vqwn/evA0902vuo4+BNvYAvqB9PSIM3+BfFecCVQmQKGcga/NuLbdzw6tgGTIBmyFJ
 IEb1FUY0Dl6lNfjpdyPN9OLzKKbJx0KFSRde6VjD1enc1metUzRWw7ZEqGKJbJ+py+qGPvjY+
 qzhEw9S61SvpVgEFsfCOQIyo07tMcW6ikNf5L4TD3a+rZEg+7W+uis4O6m16aYZdCmrCBWOtP
 s6L5gLCCkuTMqxzNos5ZGASXsb8YyPGDck/WsX3Rnt3ZXHJegaz+WtXxcBh4C9pa+8kbFZaZI
 JYUtVtOzaZgvwIkm/ZXv8IDu8f+RiTjoJI2PobTQc27qYERJbUD9CIfKciGHnEgoG9Rl+XBE7
 9A2G4njOFTSW78QTg2kpzMjFm7lfK4Tu794XXIdCVVusEJV6hsqk17953pqZokz6G4BcHKg6Y
 WFloDY2CrnNEHyIxE/V7QNtpbsQ=
Precedence: bulk

If a duplicate attribute is found using kset_find_obj(), a reference
to that attribute is returned which needs to be disposed accordingly
using kobject_put(). Move the setting name validation into a separate
function to allow for this change without having to duplicate the
cleanup code for this setting.
As a side note, a very similar bug was fixed in
commit 7295a996fdab ("platform/x86: dell-sysman: Fix reference leak"),
so it seems that the bug was copied from that driver.

Compile-tested only.

Fixes: 1bcad8e510b2 ("platform/x86: think-lmi: Fix issues with duplicate a=
ttributes")
Reviewed-by: Ilpo J=C3=A4rvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
=2D--
Changes in v3:
- add Reviewed-by
Changes in v2:
- no changes
=2D--
 drivers/platform/x86/think-lmi.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think=
-lmi.c
index 4be6f28d4600..3a396b763c49 100644
=2D-- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -1344,6 +1344,24 @@ static void tlmi_release_attr(void)
 	kset_unregister(tlmi_priv.authentication_kset);
 }

+static int tlmi_validate_setting_name(struct kset *attribute_kset, char *=
name)
+{
+	struct kobject *duplicate;
+
+	if (!strcmp(name, "Reserved"))
+		return -EINVAL;
+
+	duplicate =3D kset_find_obj(attribute_kset, name);
+	if (duplicate) {
+		pr_debug("Duplicate attribute name found - %s\n", name);
+		/* kset_find_obj() returns a reference */
+		kobject_put(duplicate);
+		return -EBUSY;
+	}
+
+	return 0;
+}
+
 static int tlmi_sysfs_init(void)
 {
 	int i, ret;
@@ -1372,10 +1390,8 @@ static int tlmi_sysfs_init(void)
 			continue;

 		/* check for duplicate or reserved values */
-		if (kset_find_obj(tlmi_priv.attribute_kset, tlmi_priv.setting[i]->displ=
ay_name) ||
-		    !strcmp(tlmi_priv.setting[i]->display_name, "Reserved")) {
-			pr_debug("duplicate or reserved attribute name found - %s\n",
-				tlmi_priv.setting[i]->display_name);
+		if (tlmi_validate_setting_name(tlmi_priv.attribute_kset,
+					       tlmi_priv.setting[i]->display_name) < 0) {
 			kfree(tlmi_priv.setting[i]->possible_values);
 			kfree(tlmi_priv.setting[i]);
 			tlmi_priv.setting[i] =3D NULL;
=2D-
2.39.2