[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250704024010.2353841-1-jiangyunshui@kylinos.cn>
Date: Fri, 4 Jul 2025 10:40:10 +0800
From: Yunshui Jiang <jiangyunshui@...inos.cn>
To: linux-kernel@...r.kernel.org
Cc: linux-input@...r.kernel.org,
dmitry.torokhov@...il.com,
Yunshui Jiang <jiangyunshui@...inos.cn>
Subject: [PATCH] Input: cs40l50: Fix potential NULL dereference and memory leak
The cs40l50_upload_owt() function allocates memory via kmalloc()
without checking for allocation failure, which could lead to a
NULL pointer dereference when GFP_KERNEL allocation fails under
memory pressure.
Additionally, if any subsequent operation fails after successful
allocation, the allocated memory is not freed, causing a memory
leak.
Therefore, add a NULL check for kmalloc() and returns -ENOMEM on
failure. And use a goto cleanup pattern to ensure the allocated
memory is freed on any error path.
Signed-off-by: Yunshui Jiang <jiangyunshui@...inos.cn>
---
drivers/input/misc/cs40l50-vibra.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/input/misc/cs40l50-vibra.c b/drivers/input/misc/cs40l50-vibra.c
index dce3b0ec8cf3..c48b6c905112 100644
--- a/drivers/input/misc/cs40l50-vibra.c
+++ b/drivers/input/misc/cs40l50-vibra.c
@@ -238,25 +238,31 @@ static int cs40l50_upload_owt(struct cs40l50_work *work_data)
header.data_words = len / sizeof(u32);
new_owt_effect_data = kmalloc(sizeof(header) + len, GFP_KERNEL);
+ if (!new_owt_effect_data)
+ return -ENOMEM;
memcpy(new_owt_effect_data, &header, sizeof(header));
memcpy(new_owt_effect_data + sizeof(header), work_data->custom_data, len);
error = regmap_read(vib->regmap, vib->dsp.owt_offset_reg, &offset);
if (error)
- return error;
+ goto free_owt_data;
error = regmap_bulk_write(vib->regmap, vib->dsp.owt_base_reg +
(offset * sizeof(u32)), new_owt_effect_data,
sizeof(header) + len);
if (error)
- return error;
+ goto free_owt_data;
error = vib->dsp.write(vib->dev, vib->regmap, vib->dsp.push_owt_cmd);
if (error)
- return error;
+ goto free_owt_data;
return 0;
+
+free_owt_data:
+ kfree(new_owt_effect_data);
+ return error;
}
static void cs40l50_add_worker(struct work_struct *work)
--
2.47.1
Powered by blists - more mailing lists