| Message ID | 20231127141600.20929-2-brgl@bgdev.pl |
|---|---|
| State | New |
| Headers | show |
| Series | [v6,01/13] firmware: qcom: qseecom: fix memory leaks in error paths | expand |
On 11/27/23 15:15, Bartosz Golaszewski wrote: > From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> > > Fix instances of returning error codes directly instead of jumping to > the relevant labels where memory allocated for the SCM calls would be > freed. > > Fixes: 759e7a2b62eb ("firmware: Add support for Qualcomm UEFI Secure Application") > Reported-by: kernel test robot <lkp@intel.com> > Reported-by: Dan Carpenter <error27@gmail.com> > Closes: https://lore.kernel.org/r/202311270828.k4HGcjiL-lkp@intel.com/ > Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Thanks! Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com> > --- > .../firmware/qcom/qcom_qseecom_uefisecapp.c | 20 ++++++++++++------- > 1 file changed, 13 insertions(+), 7 deletions(-) > > diff --git a/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c b/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c > index a33acdaf7b78..32188f098ef3 100644 > --- a/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c > +++ b/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c > @@ -325,8 +325,10 @@ static efi_status_t qsee_uefi_get_variable(struct qcuefi_client *qcuefi, const e > req_data->length = req_size; > > status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name, name_length); > - if (status < 0) > - return EFI_INVALID_PARAMETER; > + if (status < 0) { > + efi_status = EFI_INVALID_PARAMETER; > + goto out_free; > + } > > memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size); > > @@ -471,8 +473,10 @@ static efi_status_t qsee_uefi_set_variable(struct qcuefi_client *qcuefi, const e > req_data->length = req_size; > > status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name, name_length); > - if (status < 0) > - return EFI_INVALID_PARAMETER; > + if (status < 0) { > + efi_status = EFI_INVALID_PARAMETER; > + goto out_free; > + } > > memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size); > > @@ -563,8 +567,10 @@ static efi_status_t qsee_uefi_get_next_variable(struct qcuefi_client *qcuefi, > memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size); > status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name, > *name_size / sizeof(*name)); > - if (status < 0) > - return EFI_INVALID_PARAMETER; > + if (status < 0) { > + efi_status = EFI_INVALID_PARAMETER; > + goto out_free; > + } > > status = qcom_qseecom_app_send(qcuefi->client, req_data, req_size, rsp_data, rsp_size); > if (status) { > @@ -635,7 +641,7 @@ static efi_status_t qsee_uefi_get_next_variable(struct qcuefi_client *qcuefi, > * have already been validated above, causing this function to > * bail with EFI_BUFFER_TOO_SMALL. > */ > - return EFI_DEVICE_ERROR; > + efi_status = EFI_DEVICE_ERROR; > } > > out_free:
diff --git a/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c b/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c index a33acdaf7b78..32188f098ef3 100644 --- a/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c +++ b/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c @@ -325,8 +325,10 @@ static efi_status_t qsee_uefi_get_variable(struct qcuefi_client *qcuefi, const e req_data->length = req_size; status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name, name_length); - if (status < 0) - return EFI_INVALID_PARAMETER; + if (status < 0) { + efi_status = EFI_INVALID_PARAMETER; + goto out_free; + } memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size); @@ -471,8 +473,10 @@ static efi_status_t qsee_uefi_set_variable(struct qcuefi_client *qcuefi, const e req_data->length = req_size; status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name, name_length); - if (status < 0) - return EFI_INVALID_PARAMETER; + if (status < 0) { + efi_status = EFI_INVALID_PARAMETER; + goto out_free; + } memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size); @@ -563,8 +567,10 @@ static efi_status_t qsee_uefi_get_next_variable(struct qcuefi_client *qcuefi, memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size); status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name, *name_size / sizeof(*name)); - if (status < 0) - return EFI_INVALID_PARAMETER; + if (status < 0) { + efi_status = EFI_INVALID_PARAMETER; + goto out_free; + } status = qcom_qseecom_app_send(qcuefi->client, req_data, req_size, rsp_data, rsp_size); if (status) { @@ -635,7 +641,7 @@ static efi_status_t qsee_uefi_get_next_variable(struct qcuefi_client *qcuefi, * have already been validated above, causing this function to * bail with EFI_BUFFER_TOO_SMALL. */ - return EFI_DEVICE_ERROR; + efi_status = EFI_DEVICE_ERROR; } out_free: