Messages in this thread Patch in this message | | | From | "Rafael J. Wysocki" <> | Subject | [PATCH v1] ACPI: utils: Fix error path in acpi_evaluate_reference() | Date | Thu, 07 Dec 2023 19:28:10 +0100 |
| |
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
If a pointer to an uninitialized struct acpi_handle_list is passed to acpi_evaluate_reference() and it decides to bail out early, either because acpi_evaluate_object() fails, or because it produces invalid data, the handles pointer from the struct acpi_handle_list will be passed to kfree() and if it is not NULL, the kernel will crash.
Address this by moving the "end" label in acpi_evaluate_reference() to the end of the function, which is sufficient, because no cleanup is needed in that case.
Fixes: 2e57d10a6591 ("ACPI: utils: Dynamically determine acpi_handle_list size") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> --- drivers/acpi/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Index: linux-pm/drivers/acpi/utils.c =================================================================== --- linux-pm.orig/drivers/acpi/utils.c +++ linux-pm/drivers/acpi/utils.c @@ -399,13 +399,13 @@ acpi_evaluate_reference(acpi_handle hand acpi_handle_debug(list->handles[i], "Found in reference list\n"); } -end: if (ACPI_FAILURE(status)) { list->count = 0; kfree(list->handles); list->handles = NULL; } +end: kfree(buffer.pointer); return status;
| |