platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call

jwrdegoede · jwrdegoede · commit 0487d4fc42d7 · 2021-08-26T16:09:43.000+02:00
As pointed out be Kees Cook if we return -EIO because the obj->type != ACPI_TYPE_BUFFER, then we must kfree the output buffer before the return. Fixes: 1a258e6 ("platform/x86: dell-smbios-wmi: Add new WMI dispatcher driver") Reported-by: Kees Cook <keescook@chromium.org> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20210826140822.71198-1-hdegoede@redhat.com
diff --git a/drivers/platform/x86/dell/dell-smbios-wmi.c b/drivers/platform/x86/dell/dell-smbios-wmi.c
@@ -69,6 +69,7 @@ static int run_smbios_call(struct wmi_device *wdev)
 		if (obj->type == ACPI_TYPE_INTEGER)
 			dev_dbg(&wdev->dev, "SMBIOS call failed: %llu\n",
 				obj->integer.value);
+		kfree(output.pointer);
 		return -EIO;
 	}
 	memcpy(input.pointer, obj->buffer.pointer, obj->buffer.length);

Original file line number	Diff line number	Diff line change
`@@ -69,6 +69,7 @@ static int run_smbios_call(struct wmi_device *wdev)`
`69`	`69`	`if (obj->type == ACPI_TYPE_INTEGER)`
`70`	`70`	`dev_dbg(&wdev->dev, "SMBIOS call failed: %llu\n",`
`71`	`71`	`obj->integer.value);`
	`72`	`+ kfree(output.pointer);`
`72`	`73`	`return -EIO;`
`73`	`74`	`}`
`74`	`75`	`memcpy(input.pointer, obj->buffer.pointer, obj->buffer.length);`