The cs40l50_upload_owt() function allocates memory via kmalloc() without checking for allocation failure, which could lead to a NULL pointer dereference when GFP_KERNEL allocation fails under memory pressure. Additionally, if any subsequent operation fails after successful allocation, the allocated memory is not freed, causing a memory leak. Therefore, add a NULL check for kmalloc() and returns -ENOMEM on failure. And use a goto cleanup pattern to ensure the allocated memory is freed on any error path. Signed-off-by: Yunshui Jiang <jiangyunshui@xxxxxxxxxx> --- drivers/input/misc/cs40l50-vibra.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/input/misc/cs40l50-vibra.c b/drivers/input/misc/cs40l50-vibra.c index dce3b0ec8cf3..c48b6c905112 100644 --- a/drivers/input/misc/cs40l50-vibra.c +++ b/drivers/input/misc/cs40l50-vibra.c @@ -238,25 +238,31 @@ static int cs40l50_upload_owt(struct cs40l50_work *work_data) header.data_words = len / sizeof(u32); new_owt_effect_data = kmalloc(sizeof(header) + len, GFP_KERNEL); + if (!new_owt_effect_data) + return -ENOMEM; memcpy(new_owt_effect_data, &header, sizeof(header)); memcpy(new_owt_effect_data + sizeof(header), work_data->custom_data, len); error = regmap_read(vib->regmap, vib->dsp.owt_offset_reg, &offset); if (error) - return error; + goto free_owt_data; error = regmap_bulk_write(vib->regmap, vib->dsp.owt_base_reg + (offset * sizeof(u32)), new_owt_effect_data, sizeof(header) + len); if (error) - return error; + goto free_owt_data; error = vib->dsp.write(vib->dev, vib->regmap, vib->dsp.push_owt_cmd); if (error) - return error; + goto free_owt_data; return 0; + +free_owt_data: + kfree(new_owt_effect_data); + return error; } static void cs40l50_add_worker(struct work_struct *work) -- 2.47.1
