lkml.org 
[lkml]   [2011]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] ACPI battery: fix possible use after free in acpi_battery_add()
Date
When acpi_battery_add_fs() fails 'battery' will be kfreed and then
used again.

Signed-off-by: Mariusz Kozlowski <mk@lab.zgora.pl>
---
drivers/acpi/battery.c | 15 ++++++---------
1 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index fcc13ac..27375e7 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -978,18 +978,15 @@ static int acpi_battery_add(struct acpi_device *device)
acpi_battery_update(battery);
#ifdef CONFIG_ACPI_PROCFS_POWER
result = acpi_battery_add_fs(device);
-#endif
- if (!result) {
- printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",
- ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),
- device->status.battery_present ? "present" : "absent");
- } else {
-#ifdef CONFIG_ACPI_PROCFS_POWER
+ if (result) {
acpi_battery_remove_fs(device);
-#endif
kfree(battery);
+ return result;
}
-
+#endif
+ printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",
+ ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),
+ device->status.battery_present ? "present" : "absent");
battery->pm_nb.notifier_call = battery_notify;
register_pm_notifier(&battery->pm_nb);

--
1.7.0.4


\
 
 \ /
  Last update: 2011-03-26 19:21    [W:3.048 / U:0.444 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site