This is a note to let you know that I've just added the patch titled
platform/x86: think-lmi: Fix memory leak when showing current settings
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
platform-x86-think-lmi-fix-memory-leak-when-showing-.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit bdd9ac77ed0ae1b58a1dd5636153027a28bc1410
Author: Armin Wolf <W_Armin@xxxxxx>
Date: Fri Mar 31 23:33:19 2023 +0200
platform/x86: think-lmi: Fix memory leak when showing current settings
[ Upstream commit a3c4c053014585dcf20f4df954791b74d8a8afcd ]
When retriving a item string with tlmi_setting(), the result has to be
freed using kfree(). In current_value_show() however, malformed
item strings are not freed, causing a memory leak.
Fix this by eliminating the early return responsible for this.
Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@xxxxxxxxxxxx>
Link: https://lore.kernel.org/platform-driver-x86/01e920bc-5882-ba0c-dd15-868bf0eca0b8@xxxxxxxxxxxx/T/#t
Tested-by: Mirsad Goran Todorovac <mirsad.todorovac@xxxxxxxxxxxx>
Fixes: 0fdf10e5fc96 ("platform/x86: think-lmi: Split current_value to reflect only the value")
Signed-off-by: Armin Wolf <W_Armin@xxxxxx>
Link: https://lore.kernel.org/r/20230331213319.41040-1-W_Armin@xxxxxx
Tested-by: Mario Limonciello <mario.limonciello@xxxxxxx>
Reviewed-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
index c9ed2644bb8a6..5676587271988 100644
--- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -514,10 +514,12 @@ static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *a
/* validate and split from `item,value` -> `value` */
value = strpbrk(item, ",");
if (!value || value == item || !strlen(value + 1))
- return -EINVAL;
+ ret = -EINVAL;
+ else
+ ret = sysfs_emit(buf, "%s\n", value + 1);
- ret = sysfs_emit(buf, "%s\n", value + 1);
kfree(item);
+
return ret;
}
