[PATCH] platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call

[PATCH] platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call

[Hans de Goede]

As pointed out be Kees Cook if we return -EIO because the
obj->type != ACPI_TYPE_BUFFER, then we must kfree the
output buffer before the return.

Fixes: 1a258e670434 ("platform/x86: dell-smbios-wmi: Add new WMI dispatcher driver")
Reported-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---
 drivers/platform/x86/dell/dell-smbios-wmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/dell/dell-smbios-wmi.c b/drivers/platform/x86/dell/dell-smbios-wmi.c
index 01ea4bb958af..931cc50136de 100644
--- a/drivers/platform/x86/dell/dell-smbios-wmi.c
+++ b/drivers/platform/x86/dell/dell-smbios-wmi.c
@@ -69,6 +69,7 @@ static int run_smbios_call(struct wmi_device *wdev)
 		if (obj->type == ACPI_TYPE_INTEGER)
 			dev_dbg(&wdev->dev, "SMBIOS call failed: %llu\n",
 				obj->integer.value);
+		kfree(output.pointer);
 		return -EIO;
 	}
 	memcpy(input.pointer, obj->buffer.pointer, obj->buffer.length);
-- 
2.31.1

Re: [PATCH] platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call

[Kees Cook]

On Thu, Aug 26, 2021 at 04:08:22PM +0200, Hans de Goede wrote:
> As pointed out be Kees Cook if we return -EIO because the
> obj->type != ACPI_TYPE_BUFFER, then we must kfree the
> output buffer before the return.
> 
> Fixes: 1a258e670434 ("platform/x86: dell-smbios-wmi: Add new WMI dispatcher driver")
> Reported-by: Kees Cook <keescook@chromium.org>
> Signed-off-by: Hans de Goede <hdegoede@redhat.com>

Excellent! Thanks for doing this. :)

-Kees

-- 
Kees Cook