[android-common:android-3.18 721/753] drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer'

[kernel test robot <lkp@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 3626 bytes --]

CC: kbuild-all(a)lists.01.org
TO: cros-kernel-buildreports(a)googlegroups.com

tree:   https://android.googlesource.com/kernel/common android-3.18
head:   45b25566bb83cdb7046b400ac6f7f7f0def86e2f
commit: 857260113eeb7c145dd939728eca0477394248f5 [721/753] platform/x86: alienware-wmi: Correct a memory leak
:::::: branch date: 26 hours ago
:::::: commit date: 5 days ago
config: x86_64-randconfig-m001-20210323 (attached as .config)
compiler: gcc-5 (Ubuntu 5.5.0-12ubuntu1) 5.5.0 20171010

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer'

vim +468 drivers/platform/x86/alienware-wmi.c

a46ad0f13bc32a Mario Limonciello 2014-04-04  438  
a46ad0f13bc32a Mario Limonciello 2014-04-04  439  /*
a46ad0f13bc32a Mario Limonciello 2014-04-04  440  	The HDMI mux sysfs node indicates the status of the HDMI input mux.
a46ad0f13bc32a Mario Limonciello 2014-04-04  441  	It can toggle between standard system GPU output and HDMI input.
a46ad0f13bc32a Mario Limonciello 2014-04-04  442  */
bc2ef884320bdc Mario Limonciello 2014-05-07  443  static acpi_status alienware_hdmi_command(struct hdmi_args *in_args,
bc2ef884320bdc Mario Limonciello 2014-05-07  444  					  u32 command, int *out_data)
a46ad0f13bc32a Mario Limonciello 2014-04-04  445  {
a46ad0f13bc32a Mario Limonciello 2014-04-04  446  	acpi_status status;
a46ad0f13bc32a Mario Limonciello 2014-04-04  447  	union acpi_object *obj;
bc2ef884320bdc Mario Limonciello 2014-05-07  448  	struct acpi_buffer input;
bc2ef884320bdc Mario Limonciello 2014-05-07  449  	struct acpi_buffer output;
bc2ef884320bdc Mario Limonciello 2014-05-07  450  
bc2ef884320bdc Mario Limonciello 2014-05-07  451  	input.length = (acpi_size) sizeof(*in_args);
bc2ef884320bdc Mario Limonciello 2014-05-07  452  	input.pointer = in_args;
b6f226670369d6 Colin Ian King    2019-03-30  453  	if (out_data) {
bc2ef884320bdc Mario Limonciello 2014-05-07  454  		output.length = ACPI_ALLOCATE_BUFFER;
bc2ef884320bdc Mario Limonciello 2014-05-07  455  		output.pointer = NULL;
bc2ef884320bdc Mario Limonciello 2014-05-07  456  		status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
bc2ef884320bdc Mario Limonciello 2014-05-07  457  					     command, &input, &output);
b6f226670369d6 Colin Ian King    2019-03-30  458  		if (ACPI_SUCCESS(status)) {
bc2ef884320bdc Mario Limonciello 2014-05-07  459  			obj = (union acpi_object *)output.pointer;
bc2ef884320bdc Mario Limonciello 2014-05-07  460  			if (obj && obj->type == ACPI_TYPE_INTEGER)
bc2ef884320bdc Mario Limonciello 2014-05-07  461  				*out_data = (u32)obj->integer.value;
bc2ef884320bdc Mario Limonciello 2014-05-07  462  		}
b6f226670369d6 Colin Ian King    2019-03-30  463  		kfree(output.pointer);
b6f226670369d6 Colin Ian King    2019-03-30  464  	} else {
b6f226670369d6 Colin Ian King    2019-03-30  465  		status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
b6f226670369d6 Colin Ian King    2019-03-30  466  					     command, &input, NULL);
b6f226670369d6 Colin Ian King    2019-03-30  467  	}
857260113eeb7c Mario Limonciello 2018-09-10 @468  	kfree(output.pointer);
bc2ef884320bdc Mario Limonciello 2014-05-07  469  	return status;
bc2ef884320bdc Mario Limonciello 2014-05-07  470  }
bc2ef884320bdc Mario Limonciello 2014-05-07  471  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 22651 bytes --]