Patch "platform/x86: think-lmi: Abort probe on analyze failure" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    platform/x86: think-lmi: Abort probe on analyze failure

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     platform-x86-think-lmi-abort-probe-on-analyze-failur.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 8033bdca22bb51a17bee67b2c65df92dd35fc8e3
Author: Alex Williamson <alex.williamson@xxxxxxxxxx>
Date:   Mon Nov 8 11:03:57 2021 -0700

    platform/x86: think-lmi: Abort probe on analyze failure
    
    [ Upstream commit 812fcc609502096e98cc3918a4b807722dba8fd9 ]
    
    A Lenovo ThinkStation S20 (4157CTO BIOS 60KT41AUS) fails to boot on
    recent kernels including the think-lmi driver, due to the fact that
    errors returned by the tlmi_analyze() function are ignored by
    tlmi_probe(), where  tlmi_sysfs_init() is called unconditionally.
    This results in making use of an array of already freed, non-null
    pointers and other uninitialized globals, causing all sorts of nasty
    kobject and memory faults.
    
    Make use of the analyze function return value, free a couple leaked
    allocations, and remove the settings_count field, which is incremented
    but never consumed.
    
    Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
    Signed-off-by: Alex Williamson <alex.williamson@xxxxxxxxxx>
    Reviewed-by: Mark Gross <markgross@xxxxxxxxxx>
    Reviewed-by: Mark Pearson <markpearson@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/163639463588.1330483.15850167112490200219.stgit@omen
    Reviewed-by: Hans de Goede <hdegoede@xxxxxxxxxx>
    Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
index 9472aae72df29..c4d9c45350f7c 100644
--- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -888,8 +888,10 @@ static int tlmi_analyze(void)
 			break;
 		if (!item)
 			break;
-		if (!*item)
+		if (!*item) {
+			kfree(item);
 			continue;
+		}
 
 		/* It is not allowed to have '/' for file name. Convert it into '\'. */
 		strreplace(item, '/', '\\');
@@ -902,6 +904,7 @@ static int tlmi_analyze(void)
 		setting = kzalloc(sizeof(*setting), GFP_KERNEL);
 		if (!setting) {
 			ret = -ENOMEM;
+			kfree(item);
 			goto fail_clear_attr;
 		}
 		setting->index = i;
@@ -916,7 +919,6 @@ static int tlmi_analyze(void)
 		}
 		kobject_init(&setting->kobj, &tlmi_attr_setting_ktype);
 		tlmi_priv.setting[i] = setting;
-		tlmi_priv.settings_count++;
 		kfree(item);
 	}
 
@@ -983,7 +985,12 @@ static void tlmi_remove(struct wmi_device *wdev)
 
 static int tlmi_probe(struct wmi_device *wdev, const void *context)
 {
-	tlmi_analyze();
+	int ret;
+
+	ret = tlmi_analyze();
+	if (ret)
+		return ret;
+
 	return tlmi_sysfs_init();
 }
 
diff --git a/drivers/platform/x86/think-lmi.h b/drivers/platform/x86/think-lmi.h
index f8e26823075fd..2ce5086a5af27 100644
--- a/drivers/platform/x86/think-lmi.h
+++ b/drivers/platform/x86/think-lmi.h
@@ -55,7 +55,6 @@ struct tlmi_attr_setting {
 struct think_lmi {
 	struct wmi_device *wmi_device;
 
-	int settings_count;
 	bool can_set_bios_settings;
 	bool can_get_bios_selections;
 	bool can_set_bios_password;