Messages in this thread Patch in this message | | | From | Mariusz Kozlowski <> | Subject | [PATCH] ACPI battery: fix possible use after free in acpi_battery_add() | Date | Sat, 26 Mar 2011 19:18:26 +0100 |
| |
When acpi_battery_add_fs() fails 'battery' will be kfreed and then used again.
Signed-off-by: Mariusz Kozlowski <mk@lab.zgora.pl> --- drivers/acpi/battery.c | 15 ++++++--------- 1 files changed, 6 insertions(+), 9 deletions(-)
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c index fcc13ac..27375e7 100644 --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -978,18 +978,15 @@ static int acpi_battery_add(struct acpi_device *device) acpi_battery_update(battery); #ifdef CONFIG_ACPI_PROCFS_POWER result = acpi_battery_add_fs(device); -#endif - if (!result) { - printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n", - ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device), - device->status.battery_present ? "present" : "absent"); - } else { -#ifdef CONFIG_ACPI_PROCFS_POWER + if (result) { acpi_battery_remove_fs(device); -#endif kfree(battery); + return result; } - +#endif + printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n", + ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device), + device->status.battery_present ? "present" : "absent"); battery->pm_nb.notifier_call = battery_notify; register_pm_notifier(&battery->pm_nb); -- 1.7.0.4
| |