Re: [PATCH 1/3] ti_sci: Prevent memory leak

[Kumar, Udit]

On 10/6/2025 8:49 PM, Andrew Goodbody wrote:

temp is assigned the pointer returned by malloc which is used without a
NULL check and then never freed. Add a NULL check and ensure temp is
freed on all return paths.

This issue was found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodb...@linaro.org>
---
  drivers/firmware/ti_sci.c | 16 +++++++++++++---
  1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
index 
8013afef304dfb70ab14150ddc49d43ebebb5902..f262da188f675b95ae217df418dc6df0364b4425
 100644
--- a/drivers/firmware/ti_sci.c
+++ b/drivers/firmware/ti_sci.c
@@ -3084,17 +3084,24 @@ devm_ti_sci_get_of_resource(const struct ti_sci_handle 
*handle,
                return ERR_PTR(sets);
        }
        temp = malloc(sets);
+       if (!temp)
+               return ERR_PTR(-ENOMEM);
+

I suggest to move malloc to devm_kmalloc,

        sets /= sizeof(u32);
        res->sets = sets;

res->desc = devm_kcalloc(dev, res->sets, sizeof(*res->desc),

                                 GFP_KERNEL);
-       if (!res->desc)
+       if (!res->desc) {
+               free(temp);
                return ERR_PTR(-ENOMEM);
+       }

ret = dev_read_u32_array(dev, of_prop, temp, res->sets);

-       if (ret)
+       if (ret) {
+               free(temp);
                return ERR_PTR(-EINVAL);
+       }

for (i = 0; i < res->sets; i++) {

                resource_subtype = temp[i];
@@ -3119,10 +3126,13 @@ devm_ti_sci_get_of_resource(const struct ti_sci_handle 
*handle,
                res->desc[i].res_map =
                        devm_kzalloc(dev, BITS_TO_LONGS(res->desc[i].num) *
                                     sizeof(*res->desc[i].res_map), GFP_KERNEL);
-               if (!res->desc[i].res_map)
+               if (!res->desc[i].res_map) {
+                       free(temp);
                        return ERR_PTR(-ENOMEM);
+               }
        }

+ free(temp);

Please move to devm_kfree(temp),

rest of free(temp) in if condition could be dropped.

        if (valid_set)
                return res;