From 4b8bc5af80f1637cd71a1b6a0dffa7588a03f27c Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Wed, 8 Oct 2025 10:23:35 +0100 Subject: [PATCH 1/3] ti_sci: Prevent memory leak temp is assigned the pointer returned by malloc which is used without a NULL check and then never freed. Add a NULL check and ensure temp is freed on all return paths. This issue was found by Smatch. Reviewed-by: Udit Kumar Signed-off-by: Andrew Goodbody Reviewed-by: Nishanth Menon Tested-by: Anshul Dalal --- drivers/firmware/ti_sci.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c index 8013afef304..2042d885837 100644 --- a/drivers/firmware/ti_sci.c +++ b/drivers/firmware/ti_sci.c @@ -3083,7 +3083,10 @@ devm_ti_sci_get_of_resource(const struct ti_sci_handle *handle, dev_err(dev, "%s resource type ids not available\n", of_prop); return ERR_PTR(sets); } - temp = malloc(sets); + temp = devm_kmalloc(dev, sets, GFP_KERNEL); + if (!temp) + return ERR_PTR(-ENOMEM); + sets /= sizeof(u32); res->sets = sets; @@ -3123,6 +3126,7 @@ devm_ti_sci_get_of_resource(const struct ti_sci_handle *handle, return ERR_PTR(-ENOMEM); } + devm_kfree(dev, temp); if (valid_set) return res; From 4602fa92202388665ddfbb622f001d62b1473a08 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Wed, 8 Oct 2025 10:23:36 +0100 Subject: [PATCH 2/3] ti_sci: Provide error code on error exit In ti_sci_get_response the check for message sequence will return ret on a fail but ret will be 0 at that point. Instead return -EINVAL. Also change dev_dbg call to dev_err to be consistent with other error detection code in the same function. This issue was found by Smatch. Reviewed-by: Udit Kumar Signed-off-by: Andrew Goodbody Reviewed-by: Nishanth Menon Tested-by: Anshul Dalal --- drivers/firmware/ti_sci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c index 2042d885837..534326be5ec 100644 --- a/drivers/firmware/ti_sci.c +++ b/drivers/firmware/ti_sci.c @@ -191,9 +191,9 @@ static int ti_sci_get_response(struct ti_sci_info *info, /* Sanity check for message response */ if (hdr->seq != info->seq) { - dev_dbg(info->dev, "%s: Message for %d is not expected\n", + dev_err(info->dev, "%s: Message for %d is not expected\n", __func__, hdr->seq); - return ret; + return -EINVAL; } if (msg->len > info->desc->max_msg_size) { From 5b9125746dfde0a29911ccd542801da6b8f94239 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Wed, 8 Oct 2025 10:23:37 +0100 Subject: [PATCH 3/3] ti_sci: Pointer is never assigned to valid value The pointer resp is declared but never assigned a value but is then dereferenced. Fix this by assigning the pointer to the message buffer. This issue was found by Smatch. Reviewed-by: Udit Kumar Signed-off-by: Andrew Goodbody Reviewed-by: Nishanth Menon Tested-by: Anshul Dalal --- drivers/firmware/ti_sci.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c index 534326be5ec..6f57dcfe8de 100644 --- a/drivers/firmware/ti_sci.c +++ b/drivers/firmware/ti_sci.c @@ -1365,6 +1365,8 @@ static int ti_sci_cmd_clk_get_parent(const struct ti_sci_handle *handle, if (ret) return ret; + resp = (struct ti_sci_msg_resp_get_clock_parent *)xfer->tx_message.buf; + *parent_id = resp->parent_id; return ret;