platform/x86: think-lmi: Fix kobject cleanup

commit 9110056fe10b0519529bdbbac37311a5037ea0c2 upstream.

In tlmi_analyze(), allocated structs with an embedded kobject are freed
in error paths after the they were already initialized.

Fix this by first by avoiding the initialization of kobjects in
tlmi_analyze() and then by correctly cleaning them up in
tlmi_release_attr() using their kset's kobject list.

Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
Fixes: 30e78435d3bf ("platform/x86: think-lmi: Split kobject_init() and kobject_add() calls")
Cc: stable@vger.kernel.org
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Kurt Borja <kuurtb@gmail.com>
Link: https://lore.kernel.org/r/20250630-lmi-fix-v3-2-ce4f81c9c481@gmail.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
index 34b991ef1506d6eb20ddbef423a6c964efbce1fa..8f72cde75377b636acbac7aa239e097ee30c8245 100644 (file)
--- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -1313,13 +1313,13 @@ static struct kobj_attribute debug_cmd = __ATTR_WO(debug_cmd);
 /* ---- Initialisation --------------------------------------------------------- */
 static void tlmi_release_attr(void)
 {
+       struct kobject *pos, *n;
        int i;
 
        /* Attribute structures */
        for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
                if (tlmi_priv.setting[i]) {
                        sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);
-                       kobject_put(&tlmi_priv.setting[i]->kobj);
                }
        }
        sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
@@ -1328,6 +1328,9 @@ static void tlmi_release_attr(void)
        if (tlmi_priv.can_debug_cmd && debug_support)
                sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);
 
+       list_for_each_entry_safe(pos, n, &tlmi_priv.attribute_kset->list, entry)
+               kobject_put(pos);
+
        kset_unregister(tlmi_priv.attribute_kset);
 
        /* Free up any saved signatures */
@@ -1336,19 +1339,17 @@ static void tlmi_release_attr(void)
 
        /* Authentication structures */
        sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group);
-       kobject_put(&tlmi_priv.pwd_admin->kobj);
        sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group);
-       kobject_put(&tlmi_priv.pwd_power->kobj);
 
        if (tlmi_priv.opcode_support) {
                sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group);
-               kobject_put(&tlmi_priv.pwd_system->kobj);
                sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group);
-               kobject_put(&tlmi_priv.pwd_hdd->kobj);
                sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group);
-               kobject_put(&tlmi_priv.pwd_nvme->kobj);
        }
 
+       list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry)
+               kobject_put(pos);
+
        kset_unregister(tlmi_priv.authentication_kset);
 }
 
@@ -1412,8 +1413,8 @@ static int tlmi_sysfs_init(void)
 
                /* Build attribute */
                tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset;
-               ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL,
-                                 "%s", tlmi_priv.setting[i]->display_name);
+               ret = kobject_init_and_add(&tlmi_priv.setting[i]->kobj, &tlmi_attr_setting_ktype,
+                                          NULL, "%s", tlmi_priv.setting[i]->display_name);
                if (ret)
                        goto fail_create_attr;
 
@@ -1438,7 +1439,8 @@ static int tlmi_sysfs_init(void)
 
        /* Create authentication entries */
        tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset;
-       ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin");
+       ret = kobject_init_and_add(&tlmi_priv.pwd_admin->kobj, &tlmi_pwd_setting_ktype,
+                                  NULL, "%s", "Admin");
        if (ret)
                goto fail_create_attr;
 
@@ -1447,7 +1449,8 @@ static int tlmi_sysfs_init(void)
                goto fail_create_attr;
 
        tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset;
-       ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on");
+       ret = kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_setting_ktype,
+                                  NULL, "%s", "Power-on");
        if (ret)
                goto fail_create_attr;
 
@@ -1457,7 +1460,8 @@ static int tlmi_sysfs_init(void)
 
        if (tlmi_priv.opcode_support) {
                tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset;
-               ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System");
+               ret = kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_setting_ktype,
+                                          NULL, "%s", "System");
                if (ret)
                        goto fail_create_attr;
 
@@ -1466,7 +1470,8 @@ static int tlmi_sysfs_init(void)
                        goto fail_create_attr;
 
                tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset;
-               ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD");
+               ret = kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting_ktype,
+                                          NULL, "%s", "HDD");
                if (ret)
                        goto fail_create_attr;
 
@@ -1475,7 +1480,8 @@ static int tlmi_sysfs_init(void)
                        goto fail_create_attr;
 
                tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset;
-               ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe");
+               ret = kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_setting_ktype,
+                                          NULL, "%s", "NVMe");
                if (ret)
                        goto fail_create_attr;
 
@@ -1512,8 +1518,6 @@ static struct tlmi_pwd_setting *tlmi_create_auth(const char *pwd_type,
        new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length;
        new_pwd->index = 0;
 
-       kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype);
-
        return new_pwd;
 }
 
@@ -1617,7 +1621,6 @@ static int tlmi_analyze(void)
                if (setting->possible_values)
                        strreplace(setting->possible_values, ',', ';');
 
-               kobject_init(&setting->kobj, &tlmi_attr_setting_ktype);
                tlmi_priv.setting[i] = setting;
                kfree(item);
        }