[PATCH v4 2/2] platform/x86: int1092: Fix info leak in parse_package()

[Abdun Nihaal]

Sashiko reports a possible information leak that can occur as follows:
- In parse_package(), memory allocated for data->device_mode_info is not
  zeroized initially as it is allocated with devm_kmalloc_array()
- In the for loop after the allocation, a malformed ACPI package
  provided by firmware can cause some fields in data->device_mode_info
  to remain uninitialized
- Later in update_sar_data(), the uninitialized fields gets copied to
  the fields of context->sar_data, which can be exposed to userspace
  through sysfs attribute read (intc_data_show())

Fix the leak by switching to use devm_kcalloc() for allocation.

Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Closes: https://sashiko.dev/#/patchset/20260710052806.100107-1-nihaal%40cse.iitm.ac.in
Signed-off-by: Abdun Nihaal <nihaal@xxxxxxxxxxxxxx>
---
Newly added in v3

v3->v4:
- Updated the commit message with the information leak path as suggested
  by Ilpo Järvinen.
---
 drivers/platform/x86/intel/int1092/intel_sar.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/intel/int1092/intel_sar.c b/drivers/platform/x86/intel/int1092/intel_sar.c
index 7263114f0b3d..f506155f35d4 100644
--- a/drivers/platform/x86/intel/int1092/intel_sar.c
+++ b/drivers/platform/x86/intel/int1092/intel_sar.c
@@ -91,10 +91,10 @@ static acpi_status parse_package(struct wwan_sar_context *context, union acpi_ob
 	    item->package.count <= data->total_dev_mode)
 		return AE_ERROR;
 
-	data->device_mode_info = devm_kmalloc_array(&context->sar_device->dev,
-						    data->total_dev_mode,
-						    sizeof(*data->device_mode_info),
-						    GFP_KERNEL);
+	data->device_mode_info = devm_kcalloc(&context->sar_device->dev,
+					      data->total_dev_mode,
+					      sizeof(*data->device_mode_info),
+					      GFP_KERNEL);
 	if (!data->device_mode_info)
 		return AE_ERROR;
 

-- 
2.43.0