[PATCH] iio: adc: meson-saradc: fix calibration buffer leak on error

[Jonathan Cameron]

On Sat, 25 Apr 2026 12:20:55 -0700
Rosen Penev <rosenp at gmail.com> wrote:

> On Sat, Apr 25, 2026 at 9:07 AM Felix Gu <ustc.gu at gmail.com> wrote:
> >
> > meson_sar_adc_temp_sensor_init() allocates a buffer with
> > nvmem_cell_read(), but the old code leaked it if
> > syscon_regmap_lookup_by_phandle() failed.
> >
> > Switch buf to __free(kfree) so all return paths release it.
> >
> > Fixes: d6f2eac64403 ("iio: adc: meson: no devm for nvmem_cell_get")
> > Signed-off-by: Felix Gu <ustc.gu at gmail.com>
> > ---
> >  drivers/iio/adc/meson_saradc.c | 10 +++-------
> >  1 file changed, 3 insertions(+), 7 deletions(-)
> >
> > diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
> > index 23991a3612bd..9708ddcc4919 100644
> > --- a/drivers/iio/adc/meson_saradc.c
> > +++ b/drivers/iio/adc/meson_saradc.c
> > @@ -786,7 +786,7 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev,
> >  static int meson_sar_adc_temp_sensor_init(struct iio_dev *indio_dev)
> >  {
> >         struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
> > -       u8 *buf, trimming_bits, trimming_mask, upper_adc_val;
> > +       u8 trimming_bits, trimming_mask, upper_adc_val;
> >         struct device *dev = indio_dev->dev.parent;
> >         struct nvmem_cell *temperature_calib;
> >         size_t read_len;
> > @@ -807,14 +807,12 @@ static int meson_sar_adc_temp_sensor_init(struct iio_dev *indio_dev)
> >         }
> >
> >         read_len = MESON_SAR_ADC_EFUSE_BYTES;
> > -       buf = nvmem_cell_read(temperature_calib, &read_len);
> > +       u8 *buf __free(kfree) = nvmem_cell_read(temperature_calib, &read_len);
> >         nvmem_cell_put(temperature_calib);
> >         if (IS_ERR(buf))
> >                 return dev_err_probe(dev, PTR_ERR(buf), "failed to read temperature_calib cell\n");
> > -       if (read_len != MESON_SAR_ADC_EFUSE_BYTES) {
> > -               kfree(buf);  
> I don't like this. Just add the missing kfree.

That is the minimal fix, so we should probably do that first
even if we then circle back to consider if __free() magic is worth using here.

J
> > +       if (read_len != MESON_SAR_ADC_EFUSE_BYTES)
> >                 return dev_err_probe(dev, -EINVAL, "invalid read size of temperature_calib cell\n");
> > -       }
> >
> >         priv->tsc_regmap = syscon_regmap_lookup_by_phandle(dev->of_node, "amlogic,hhi-sysctrl");
> >         if (IS_ERR(priv->tsc_regmap))
> > @@ -835,8 +833,6 @@ static int meson_sar_adc_temp_sensor_init(struct iio_dev *indio_dev)
> >         priv->temperature_sensor_adc_val |= upper_adc_val << BITS_PER_BYTE;
> >         priv->temperature_sensor_adc_val >>= trimming_bits;
> >
> > -       kfree(buf);
> > -
> >         return 0;
> >  }
> >
> >
> > ---
> > base-commit: 7080e32d3f09d8688c4a87d81bdcc71f7f606b16
> > change-id: 20260425-meson_saradc-54abc52d9b31
> >
> > Best regards,
> > --
> > Felix Gu <ustc.gu at gmail.com>
> >