wifi: iwlwifi: avoid memory leak

A caller of iwl_acpi_get_dsm_object must free the returned object.
iwl_acpi_get_dsm_integer returns immediately without freeing
it if the expected size is more than 8 bytes. Fix that.

Note that with the current code this will never happen, since the caller
of iwl_acpi_get_dsm_integer already checks that the expected size if
either 1 or 4 bytes, so it can't exceed 8 bytes.

While at it, print the DSM value instead of the return value, as this
was the intention in the first place.

Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20241228223206.bf61eaab99f8.Ibdc5df02f885208c222456d42c889c43b7e3b2f7@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
index d3ab40fc8ab09ec30bd99c9f8b495c2d71f910e1..b32d5141dbbe669278ab6e2b71b373356859e0dd 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -108,7 +108,7 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
                                    size_t expected_size)
 {
        union acpi_object *obj;
-       int ret = 0;
+       int ret;
 
        obj = iwl_acpi_get_dsm_object(dev, rev, func, NULL, guid);
        if (IS_ERR(obj)) {
@@ -123,8 +123,10 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
        } else if (obj->type == ACPI_TYPE_BUFFER) {
                __le64 le_value = 0;
 
-               if (WARN_ON_ONCE(expected_size > sizeof(le_value)))
-                       return -EINVAL;
+               if (WARN_ON_ONCE(expected_size > sizeof(le_value))) {
+                       ret = -EINVAL;
+                       goto out;
+               }
 
                /* if the buffer size doesn't match the expected size */
                if (obj->buffer.length != expected_size)
@@ -145,8 +147,9 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
        }
 
        IWL_DEBUG_DEV_RADIO(dev,
-                           "ACPI: DSM method evaluated: func=%d, ret=%d\n",
-                           func, ret);
+                           "ACPI: DSM method evaluated: func=%d, value=%lld\n",
+                           func, *value);
+       ret = 0;
 out:
        ACPI_FREE(obj);
        return ret;