lkml.org 
[lkml]   [2010]   [Jul]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH v2] acer-wmi: fix memory leaks in wmab_execute error path
    From
    Date
    When acpi_evaluate_object() is passed ACPI_ALLOCATE_BUFFER,
    the caller must kfree the returned buffer if AE_OK is returned.

    Call Trace:
    wmab_execute
    -> wmi_evaluate_method
    -> acpi_evaluate_object

    Thus if callers of wmab_execute() pass ACPI_ALLOCATE_BUFFER,
    the return buffer must be kfreed if wmab_execute return AE_OK.

    Signed-off-by: Axel Lin <axel.lin@gmail.com>
    ---
    drivers/platform/x86/acer-wmi.c | 11 ++++++++++-
    1 files changed, 10 insertions(+), 1 deletions(-)

    diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
    index 1ea6c43..3f44446 100644
    --- a/drivers/platform/x86/acer-wmi.c
    +++ b/drivers/platform/x86/acer-wmi.c
    @@ -555,6 +555,7 @@ static acpi_status AMW0_find_mailled(void)
    obj->buffer.length == sizeof(struct wmab_ret)) {
    ret = *((struct wmab_ret *) obj->buffer.pointer);
    } else {
    + kfree(out.pointer);
    return AE_ERROR;
    }

    @@ -598,6 +599,7 @@ static acpi_status AMW0_set_capabilities(void)
    obj->buffer.length == sizeof(struct wmab_ret)) {
    ret = *((struct wmab_ret *) obj->buffer.pointer);
    } else {
    + kfree(out.pointer);
    return AE_ERROR;
    }

    @@ -607,15 +609,22 @@ static acpi_status AMW0_set_capabilities(void)
    args.ebx = 2 << 8;
    args.ebx |= ACER_AMW0_BLUETOOTH_MASK;

    + /*
    + * It's ok to use existing buffer for next wmab_execute call.
    + * But we need to kfree(out.pointer) if next wmab_execute fail.
    + */
    status = wmab_execute(&args, &out);
    - if (ACPI_FAILURE(status))
    + if (ACPI_FAILURE(status)) {
    + kfree(out.pointer);
    return status;
    + }

    obj = (union acpi_object *) out.pointer;
    if (obj && obj->type == ACPI_TYPE_BUFFER
    && obj->buffer.length == sizeof(struct wmab_ret)) {
    ret = *((struct wmab_ret *) obj->buffer.pointer);
    } else {
    + kfree(out.pointer);
    return AE_ERROR;
    }

    --
    1.5.4.3




    \
     
     \ /
      Last update: 2010-07-09 06:39    [W:0.021 / U:1.000 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site