[PATCH 4.19 111/264] nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell()

[Greg Kroah-Hartman]

From: Vadym Kochan <vadym.koc...@plvision.eu>

[ Upstream commit fc9eec4d643597cf4cb2fef17d48110e677610da ]

Fix missing 'kfree_const(cell->name)' when call to
nvmem_cell_info_to_nvmem_cell() in several places:

     * after nvmem_cell_info_to_nvmem_cell() failed during
       nvmem_add_cells()

     * during nvmem_device_cell_{read,write} when cell->name is
       kstrdup'ed() without calling kfree_const() at the end, but
       really there is no reason to do that 'dup, because the cell
       instance is allocated on the stack for some short period to be
       read/write without exposing it to the caller.

So the new nvmem_cell_info_to_nvmem_cell_nodup() helper is introduced
which is used to convert cell_info -> cell without name duplication as
a lighweight version of nvmem_cell_info_to_nvmem_cell().

Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")
Reviewed-by: Srinivas Kandagatla <srinivas.kandaga...@linaro.org>
Acked-by: Srinivas Kandagatla <srinivas.kandaga...@linaro.org>
Signed-off-by: Vadym Kochan <vadym.koc...@plvision.eu>
Link: https://lore.kernel.org/r/20200923204456.14032-1-vadym.koc...@plvision.eu
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Signed-off-by: Sasha Levin <sas...@kernel.org>
---
 drivers/nvmem/core.c | 29 +++++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 30c040786fde2..54204d550fc22 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -326,9 +326,9 @@ static void nvmem_cell_add(struct nvmem_cell *cell)
        mutex_unlock(&nvmem_cells_mutex);
 }
 
-static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
-                                  const struct nvmem_cell_info *info,
-                                  struct nvmem_cell *cell)
+static int nvmem_cell_info_to_nvmem_cell_nodup(struct nvmem_device *nvmem,
+                                       const struct nvmem_cell_info *info,
+                                       struct nvmem_cell *cell)
 {
        cell->nvmem = nvmem;
        cell->offset = info->offset;
@@ -345,13 +345,30 @@ static int nvmem_cell_info_to_nvmem_cell(struct 
nvmem_device *nvmem,
        if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
                dev_err(&nvmem->dev,
                        "cell %s unaligned to nvmem stride %d\n",
-                       cell->name, nvmem->stride);
+                       cell->name ?: "<unknown>", nvmem->stride);
                return -EINVAL;
        }
 
        return 0;
 }
 
+static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
+                               const struct nvmem_cell_info *info,
+                               struct nvmem_cell *cell)
+{
+       int err;
+
+       err = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, cell);
+       if (err)
+               return err;
+
+       cell->name = kstrdup_const(info->name, GFP_KERNEL);
+       if (!cell->name)
+               return -ENOMEM;
+
+       return 0;
+}
+
 /**
  * nvmem_add_cells() - Add cell information to an nvmem device
  *
@@ -1265,7 +1282,7 @@ ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem,
        if (!nvmem)
                return -EINVAL;
 
-       rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
+       rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);
        if (rc)
                return rc;
 
@@ -1295,7 +1312,7 @@ int nvmem_device_cell_write(struct nvmem_device *nvmem,
        if (!nvmem)
                return -EINVAL;
 
-       rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
+       rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);
        if (rc)
                return rc;
 
-- 
2.25.1