diff options
| author | Roland Dreier <rolanddreier@rivian.com> | 2026-09-09 17:58:59 +0000 |
|---|---|---|
| committer | Sudeep Holla <sudeep.holla@kernel.org> | 2026-09-10 14:02:35 +0100 |
| commit | 1adabdce41b93ee6f72f29daa1d3e1750e7b7bd1 (patch) | |
| tree | 34e42d6ef78d19845e59b53357160eff1fcae31e | |
| parent | 0543fc1443de1a0b04ec64684fb920d79e15de2f (diff) | |
| download | linux-next-1adabdce41b93ee6f72f29daa1d3e1750e7b7bd1.tar.gz linux-next-1adabdce41b93ee6f72f29daa1d3e1750e7b7bd1.zip | |
firmware: arm_scmi: Fix error path leak in scmi_raw_message_send()
When the is_transport_polling_capable() check fails in scmi_raw_message_send(),
it returns -EINVAL without doing scmi_xfer_raw_put(), which will leak a
struct scmi_xfer.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260909-scmi-async-done-race-v2-0-cc5dec25c6be%40rivian.com
Fixes: 07cb8c324b63 ("firmware: arm_scmi: Add polling support to raw mode")
Signed-off-by: Roland Dreier <rolanddreier@rivian.com>
Link: https://patch.msgid.link/20260909-scmi-raw-v1-1-de3fa75d2c6f@rivian.com
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
| -rw-r--r-- | drivers/firmware/arm_scmi/raw_mode.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/firmware/arm_scmi/raw_mode.c b/drivers/firmware/arm_scmi/raw_mode.c index 5ee21f6b7001..f01bf2f6ce1d 100644 --- a/drivers/firmware/arm_scmi/raw_mode.c +++ b/drivers/firmware/arm_scmi/raw_mode.c @@ -711,6 +711,7 @@ static int scmi_raw_message_send(struct scmi_raw_mode_info *raw, } else { dev_err(raw->handle->dev, "Failed to send RAW message - Polling NOT supported\n"); + scmi_xfer_raw_put(raw->handle, xfer); return -EINVAL; } } |