amd_pmf_get_pb_data() will allocate memory for the policy buffer, but does not free it if copy_from_user() fails. This leads to a memory leak.
Unified · Split
| @@ -298,8 +298,10 @@ static ssize_t amd_pmf_get_pb_data(struct file *filp, const char __user *buf, · 297 unmodified lines | ||
| 298 | 298 | if (!new_policy_buf) |
| 299 | 299 | return -ENOMEM; |
| 300 | 300 | |
| 301 | − if (copy_from_user(new_policy_buf, buf, length)) | |
| 301 | + if (copy_from_user(new_policy_buf, buf, length)) { | |
| 302 | + kfree(new_policy_buf); | |
| 302 | 303 | return -EFAULT; |
| 304 | + } | |
| 303 | 305 | |
| 304 | 306 | kfree(dev->policy_buf); |
| 305 | 307 | dev->policy_buf = new_policy_buf; |