[PATCH] Input: cs40l50: Fix potential NULL dereference and memory leak

[Yunshui Jiang]

The cs40l50_upload_owt() function allocates memory via kmalloc()
without checking for allocation failure, which could lead to a
NULL pointer dereference when GFP_KERNEL allocation fails under
memory pressure.

Additionally, if any subsequent operation fails after successful
allocation, the allocated memory is not freed, causing a memory
leak.

Therefore, add a NULL check for kmalloc() and returns -ENOMEM on
failure. And use a goto cleanup pattern to ensure the allocated
memory is freed on any error path.

Signed-off-by: Yunshui Jiang <jiangyunshui@xxxxxxxxxx>
---
 drivers/input/misc/cs40l50-vibra.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/input/misc/cs40l50-vibra.c b/drivers/input/misc/cs40l50-vibra.c
index dce3b0ec8cf3..c48b6c905112 100644
--- a/drivers/input/misc/cs40l50-vibra.c
+++ b/drivers/input/misc/cs40l50-vibra.c
@@ -238,25 +238,31 @@ static int cs40l50_upload_owt(struct cs40l50_work *work_data)
 	header.data_words = len / sizeof(u32);
 
 	new_owt_effect_data = kmalloc(sizeof(header) + len, GFP_KERNEL);
+	if (!new_owt_effect_data)
+		return -ENOMEM;
 
 	memcpy(new_owt_effect_data, &header, sizeof(header));
 	memcpy(new_owt_effect_data + sizeof(header), work_data->custom_data, len);
 
 	error = regmap_read(vib->regmap, vib->dsp.owt_offset_reg, &offset);
 	if (error)
-		return error;
+		goto free_owt_data;
 
 	error = regmap_bulk_write(vib->regmap, vib->dsp.owt_base_reg +
 				  (offset * sizeof(u32)), new_owt_effect_data,
 				  sizeof(header) + len);
 	if (error)
-		return error;
+		goto free_owt_data;
 
 	error = vib->dsp.write(vib->dev, vib->regmap, vib->dsp.push_owt_cmd);
 	if (error)
-		return error;
+		goto free_owt_data;
 
 	return 0;
+
+free_owt_data:
+	kfree(new_owt_effect_data);
+	return error;
 }
 
 static void cs40l50_add_worker(struct work_struct *work)
-- 
2.47.1