From: kernel test robot <lkp@intel.com>
To: kbuild@lists.01.org
Subject: [android-common:android-3.18 721/1128] drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer'
Date: Sat, 08 May 2021 03:32:52 +0800 [thread overview]
Message-ID: <202105080345.gnWszPLw-lkp@intel.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 3628 bytes --]
CC: kbuild-all(a)lists.01.org
TO: cros-kernel-buildreports(a)googlegroups.com
tree: https://android.googlesource.com/kernel/common android-3.18
head: 9fdc1e6e49cc95c97f3285176b0417101f5ee38e
commit: 857260113eeb7c145dd939728eca0477394248f5 [721/1128] platform/x86: alienware-wmi: Correct a memory leak
:::::: branch date: 31 hours ago
:::::: commit date: 7 weeks ago
config: x86_64-randconfig-m001-20210507 (attached as .config)
compiler: gcc-5 (Ubuntu 5.5.0-12ubuntu1) 5.5.0 20171010
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer'
vim +468 drivers/platform/x86/alienware-wmi.c
a46ad0f13bc32a Mario Limonciello 2014-04-04 438
a46ad0f13bc32a Mario Limonciello 2014-04-04 439 /*
a46ad0f13bc32a Mario Limonciello 2014-04-04 440 The HDMI mux sysfs node indicates the status of the HDMI input mux.
a46ad0f13bc32a Mario Limonciello 2014-04-04 441 It can toggle between standard system GPU output and HDMI input.
a46ad0f13bc32a Mario Limonciello 2014-04-04 442 */
bc2ef884320bdc Mario Limonciello 2014-05-07 443 static acpi_status alienware_hdmi_command(struct hdmi_args *in_args,
bc2ef884320bdc Mario Limonciello 2014-05-07 444 u32 command, int *out_data)
a46ad0f13bc32a Mario Limonciello 2014-04-04 445 {
a46ad0f13bc32a Mario Limonciello 2014-04-04 446 acpi_status status;
a46ad0f13bc32a Mario Limonciello 2014-04-04 447 union acpi_object *obj;
bc2ef884320bdc Mario Limonciello 2014-05-07 448 struct acpi_buffer input;
bc2ef884320bdc Mario Limonciello 2014-05-07 449 struct acpi_buffer output;
bc2ef884320bdc Mario Limonciello 2014-05-07 450
bc2ef884320bdc Mario Limonciello 2014-05-07 451 input.length = (acpi_size) sizeof(*in_args);
bc2ef884320bdc Mario Limonciello 2014-05-07 452 input.pointer = in_args;
b6f226670369d6 Colin Ian King 2019-03-30 453 if (out_data) {
bc2ef884320bdc Mario Limonciello 2014-05-07 454 output.length = ACPI_ALLOCATE_BUFFER;
bc2ef884320bdc Mario Limonciello 2014-05-07 455 output.pointer = NULL;
bc2ef884320bdc Mario Limonciello 2014-05-07 456 status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
bc2ef884320bdc Mario Limonciello 2014-05-07 457 command, &input, &output);
b6f226670369d6 Colin Ian King 2019-03-30 458 if (ACPI_SUCCESS(status)) {
bc2ef884320bdc Mario Limonciello 2014-05-07 459 obj = (union acpi_object *)output.pointer;
bc2ef884320bdc Mario Limonciello 2014-05-07 460 if (obj && obj->type == ACPI_TYPE_INTEGER)
bc2ef884320bdc Mario Limonciello 2014-05-07 461 *out_data = (u32)obj->integer.value;
bc2ef884320bdc Mario Limonciello 2014-05-07 462 }
b6f226670369d6 Colin Ian King 2019-03-30 463 kfree(output.pointer);
b6f226670369d6 Colin Ian King 2019-03-30 464 } else {
b6f226670369d6 Colin Ian King 2019-03-30 465 status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
b6f226670369d6 Colin Ian King 2019-03-30 466 command, &input, NULL);
b6f226670369d6 Colin Ian King 2019-03-30 467 }
857260113eeb7c Mario Limonciello 2018-09-10 @468 kfree(output.pointer);
bc2ef884320bdc Mario Limonciello 2014-05-07 469 return status;
bc2ef884320bdc Mario Limonciello 2014-05-07 470 }
bc2ef884320bdc Mario Limonciello 2014-05-07 471
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 23980 bytes --]
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: kbuild-all@lists.01.org
Subject: [android-common:android-3.18 721/1128] drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer'
Date: Sat, 08 May 2021 11:06:32 +0300 [thread overview]
Message-ID: <202105080345.gnWszPLw-lkp@intel.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 3224 bytes --]
tree: https://android.googlesource.com/kernel/common android-3.18
head: 9fdc1e6e49cc95c97f3285176b0417101f5ee38e
commit: 857260113eeb7c145dd939728eca0477394248f5 [721/1128] platform/x86: alienware-wmi: Correct a memory leak
config: x86_64-randconfig-m001-20210507 (attached as .config)
compiler: gcc-5 (Ubuntu 5.5.0-12ubuntu1) 5.5.0 20171010
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer'
vim +468 drivers/platform/x86/alienware-wmi.c
bc2ef884320bdc Mario Limonciello 2014-05-07 443 static acpi_status alienware_hdmi_command(struct hdmi_args *in_args,
bc2ef884320bdc Mario Limonciello 2014-05-07 444 u32 command, int *out_data)
a46ad0f13bc32a Mario Limonciello 2014-04-04 445 {
a46ad0f13bc32a Mario Limonciello 2014-04-04 446 acpi_status status;
a46ad0f13bc32a Mario Limonciello 2014-04-04 447 union acpi_object *obj;
bc2ef884320bdc Mario Limonciello 2014-05-07 448 struct acpi_buffer input;
bc2ef884320bdc Mario Limonciello 2014-05-07 449 struct acpi_buffer output;
bc2ef884320bdc Mario Limonciello 2014-05-07 450
bc2ef884320bdc Mario Limonciello 2014-05-07 451 input.length = (acpi_size) sizeof(*in_args);
bc2ef884320bdc Mario Limonciello 2014-05-07 452 input.pointer = in_args;
b6f226670369d6 Colin Ian King 2019-03-30 453 if (out_data) {
bc2ef884320bdc Mario Limonciello 2014-05-07 454 output.length = ACPI_ALLOCATE_BUFFER;
bc2ef884320bdc Mario Limonciello 2014-05-07 455 output.pointer = NULL;
bc2ef884320bdc Mario Limonciello 2014-05-07 456 status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
bc2ef884320bdc Mario Limonciello 2014-05-07 457 command, &input, &output);
b6f226670369d6 Colin Ian King 2019-03-30 458 if (ACPI_SUCCESS(status)) {
bc2ef884320bdc Mario Limonciello 2014-05-07 459 obj = (union acpi_object *)output.pointer;
bc2ef884320bdc Mario Limonciello 2014-05-07 460 if (obj && obj->type == ACPI_TYPE_INTEGER)
bc2ef884320bdc Mario Limonciello 2014-05-07 461 *out_data = (u32)obj->integer.value;
bc2ef884320bdc Mario Limonciello 2014-05-07 462 }
b6f226670369d6 Colin Ian King 2019-03-30 463 kfree(output.pointer);
^^^^^^^^^^^^^^^^^^^^^
Freed
b6f226670369d6 Colin Ian King 2019-03-30 464 } else {
b6f226670369d6 Colin Ian King 2019-03-30 465 status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
b6f226670369d6 Colin Ian King 2019-03-30 466 command, &input, NULL);
b6f226670369d6 Colin Ian King 2019-03-30 467 }
857260113eeb7c Mario Limonciello 2018-09-10 @468 kfree(output.pointer);
^^^^^^^^^^^^^^^^^^^^^
Double freed.
bc2ef884320bdc Mario Limonciello 2014-05-07 469 return status;
bc2ef884320bdc Mario Limonciello 2014-05-07 470 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
next reply other threads:[~2021-05-07 19:32 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-07 19:32 kernel test robot [this message]
2021-05-08 8:06 ` [android-common:android-3.18 721/1128] drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer' Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202105080345.gnWszPLw-lkp@intel.com \
--to=lkp@intel.com \
--cc=kbuild@lists.01.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.