This is a note to let you know that I've just added the patch titled tpm: acpi: Call acpi_put_table() to fix memory leak to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tpm-acpi-call-acpi_put_table-to-fix-memory-leak.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 8740a12ca2e2959531ad253bac99ada338b33d80 Mon Sep 17 00:00:00 2001 From: Hanjun Guo <guohanjun@xxxxxxxxxx> Date: Thu, 17 Nov 2022 19:23:40 +0800 Subject: tpm: acpi: Call acpi_put_table() to fix memory leak From: Hanjun Guo <guohanjun@xxxxxxxxxx> commit 8740a12ca2e2959531ad253bac99ada338b33d80 upstream. The start and length of the event log area are obtained from TPM2 or TCPA table, so we call acpi_get_table() to get the ACPI information, but the acpi_get_table() should be coupled with acpi_put_table() to release the ACPI memory, add the acpi_put_table() properly to fix the memory leak. While we are at it, remove the redundant empty line at the end of the tpm_read_log_acpi(). Fixes: 0bfb23746052 ("tpm: Move eventlog files to a subdirectory") Fixes: 85467f63a05c ("tpm: Add support for event log pointer found in TPM2 ACPI table") Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Hanjun Guo <guohanjun@xxxxxxxxxx> Reviewed-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx> Signed-off-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/char/tpm/eventlog/acpi.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) --- a/drivers/char/tpm/eventlog/acpi.c +++ b/drivers/char/tpm/eventlog/acpi.c @@ -90,16 +90,21 @@ int tpm_read_log_acpi(struct tpm_chip *c return -ENODEV; if (tbl->header.length < - sizeof(*tbl) + sizeof(struct acpi_tpm2_phy)) + sizeof(*tbl) + sizeof(struct acpi_tpm2_phy)) { + acpi_put_table((struct acpi_table_header *)tbl); return -ENODEV; + } tpm2_phy = (void *)tbl + sizeof(*tbl); len = tpm2_phy->log_area_minimum_length; start = tpm2_phy->log_area_start_address; - if (!start || !len) + if (!start || !len) { + acpi_put_table((struct acpi_table_header *)tbl); return -ENODEV; + } + acpi_put_table((struct acpi_table_header *)tbl); format = EFI_TCG2_EVENT_LOG_FORMAT_TCG_2; } else { /* Find TCPA entry in RSDT (ACPI_LOGICAL_ADDRESSING) */ @@ -120,8 +125,10 @@ int tpm_read_log_acpi(struct tpm_chip *c break; } + acpi_put_table((struct acpi_table_header *)buff); format = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2; } + if (!len) { dev_warn(&chip->dev, "%s: TCPA log area empty\n", __func__); return -EIO; @@ -156,5 +163,4 @@ err: kfree(log->bios_event_log); log->bios_event_log = NULL; return ret; - } Patches currently in stable-queue which might be from guohanjun@xxxxxxxxxx are queue-5.10/drm-radeon-add-the-missed-acpi_put_table-to-fix-memo.patch queue-5.10/pnp-fix-name-memory-leak-in-pnp_alloc_dev.patch queue-5.10/tpm-tpm_crb-add-the-missed-acpi_put_table-to-fix-memory-leak.patch queue-5.10/tpm-tpm_tis-add-the-missed-acpi_put_table-to-fix-memory-leak.patch queue-5.10/tpm-acpi-call-acpi_put_table-to-fix-memory-leak.patch queue-5.10/acct-fix-potential-integer-overflow-in-encode_comp_t.patch