Patch "platform/x86: think-lmi: Fix reference leak" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    platform/x86: think-lmi: Fix reference leak

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     platform-x86-think-lmi-fix-reference-leak.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 223eccebc3ba7454c9b3a950ae12676728bf07f4
Author: Armin Wolf <W_Armin@xxxxxx>
Date:   Mon Sep 25 16:28:18 2023 +0200

    platform/x86: think-lmi: Fix reference leak
    
    [ Upstream commit 528ab3e605cabf2f9c9bd5944d3bfe15f6e94f81 ]
    
    If a duplicate attribute is found using kset_find_obj(), a reference
    to that attribute is returned which needs to be disposed accordingly
    using kobject_put(). Move the setting name validation into a separate
    function to allow for this change without having to duplicate the
    cleanup code for this setting.
    As a side note, a very similar bug was fixed in
    commit 7295a996fdab ("platform/x86: dell-sysman: Fix reference leak"),
    so it seems that the bug was copied from that driver.
    
    Compile-tested only.
    
    Fixes: 1bcad8e510b2 ("platform/x86: think-lmi: Fix issues with duplicate attributes")
    Reviewed-by: Mark Pearson <mpearson-lenovo@xxxxxxxxx>
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@xxxxxxxxxxxxxxx>
    Signed-off-by: Armin Wolf <W_Armin@xxxxxx>
    Link: https://lore.kernel.org/r/20230925142819.74525-2-W_Armin@xxxxxx
    Reviewed-by: Hans de Goede <hdegoede@xxxxxxxxxx>
    Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
index 76f0d04e17f30..154b1b26d03f8 100644
--- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -787,6 +787,24 @@ static void tlmi_release_attr(void)
 	kset_unregister(tlmi_priv.authentication_kset);
 }
 
+static int tlmi_validate_setting_name(struct kset *attribute_kset, char *name)
+{
+	struct kobject *duplicate;
+
+	if (!strcmp(name, "Reserved"))
+		return -EINVAL;
+
+	duplicate = kset_find_obj(attribute_kset, name);
+	if (duplicate) {
+		pr_debug("Duplicate attribute name found - %s\n", name);
+		/* kset_find_obj() returns a reference */
+		kobject_put(duplicate);
+		return -EBUSY;
+	}
+
+	return 0;
+}
+
 static int tlmi_sysfs_init(void)
 {
 	int i, ret;
@@ -815,10 +833,8 @@ static int tlmi_sysfs_init(void)
 			continue;
 
 		/* check for duplicate or reserved values */
-		if (kset_find_obj(tlmi_priv.attribute_kset, tlmi_priv.setting[i]->display_name) ||
-		    !strcmp(tlmi_priv.setting[i]->display_name, "Reserved")) {
-			pr_debug("duplicate or reserved attribute name found - %s\n",
-				tlmi_priv.setting[i]->display_name);
+		if (tlmi_validate_setting_name(tlmi_priv.attribute_kset,
+					       tlmi_priv.setting[i]->display_name) < 0) {
 			kfree(tlmi_priv.setting[i]->possible_values);
 			kfree(tlmi_priv.setting[i]);
 			tlmi_priv.setting[i] = NULL;