urma: ubcore: free the command buffer when the topo info copy fails · Pull Request !1131 · OpenCloudOS/OpenCloudOS-Kernel

## Problem

`ubcore_get_topo_info()` allocates its command buffer with `kzalloc()` and
fills it from the address supplied by the caller. When that copy fails — for
example because the address is not mapped, or the caller passes an invalid
`UBCORE_HDR_ARGS_ADDR` — the function returns `-EPERM` without freeing the
buffer.

`UBCORE_CMD_GET_TOPO_INFO` is registered without `GENL_ADMIN_PERM`, so an
unprivileged process with access to the generic netlink family can repeat the
request and leak one buffer per call, growing the kernel heap without bound.

Every other exit path of this function, and the neighbouring
`ubcore_get_topo_bonding_dev_ops()` on the same failure, free the buffer.

## Fix

Free the buffer before returning `-EPERM`.

## Verification

- `scripts/checkpatch.pl --no-signoff --strict`: 0 errors, 0 warnings.
- arm64 build (`CONFIG_UB=y` + `CONFIG_UB_URMA=y`, target `drivers/ub/urma/ubcore/`, Bootlin aarch64 gcc 15.3.0, `W=1`): baseline and patched trees both build with exit 0, all 24 objects force-recompiled in both cases, and both show the same 5 pre-existing `-Wmissing-prototypes` warnings in `ubcore_connect_adapter.c`; no new diagnostics.
- Not run: runtime regression. No UB hardware is available in the development environment; the change only affects an error path.

类型	指派人员	状态
审查	zoucao Huang Cun Jianping Liu	已完成 (0/0人)
测试	Jianping Liu	已完成 (0/0人)

GVPOpenCloudOS / OpenCloudOS-Kernel

搜索帮助

GVP OpenCloudOS / OpenCloudOS-Kernel