* [android-common:android-3.18 721/1128] drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer'
@ 2021-05-08 8:06 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: kernel test robot @ 2021-05-07 19:32 UTC (permalink / raw)
To: kbuild
[-- Attachment #1: Type: text/plain, Size: 3628 bytes --]
CC: kbuild-all(a)lists.01.org
TO: cros-kernel-buildreports(a)googlegroups.com
tree: https://android.googlesource.com/kernel/common android-3.18
head: 9fdc1e6e49cc95c97f3285176b0417101f5ee38e
commit: 857260113eeb7c145dd939728eca0477394248f5 [721/1128] platform/x86: alienware-wmi: Correct a memory leak
:::::: branch date: 31 hours ago
:::::: commit date: 7 weeks ago
config: x86_64-randconfig-m001-20210507 (attached as .config)
compiler: gcc-5 (Ubuntu 5.5.0-12ubuntu1) 5.5.0 20171010
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer'
vim +468 drivers/platform/x86/alienware-wmi.c
a46ad0f13bc32a Mario Limonciello 2014-04-04 438
a46ad0f13bc32a Mario Limonciello 2014-04-04 439 /*
a46ad0f13bc32a Mario Limonciello 2014-04-04 440 The HDMI mux sysfs node indicates the status of the HDMI input mux.
a46ad0f13bc32a Mario Limonciello 2014-04-04 441 It can toggle between standard system GPU output and HDMI input.
a46ad0f13bc32a Mario Limonciello 2014-04-04 442 */
bc2ef884320bdc Mario Limonciello 2014-05-07 443 static acpi_status alienware_hdmi_command(struct hdmi_args *in_args,
bc2ef884320bdc Mario Limonciello 2014-05-07 444 u32 command, int *out_data)
a46ad0f13bc32a Mario Limonciello 2014-04-04 445 {
a46ad0f13bc32a Mario Limonciello 2014-04-04 446 acpi_status status;
a46ad0f13bc32a Mario Limonciello 2014-04-04 447 union acpi_object *obj;
bc2ef884320bdc Mario Limonciello 2014-05-07 448 struct acpi_buffer input;
bc2ef884320bdc Mario Limonciello 2014-05-07 449 struct acpi_buffer output;
bc2ef884320bdc Mario Limonciello 2014-05-07 450
bc2ef884320bdc Mario Limonciello 2014-05-07 451 input.length = (acpi_size) sizeof(*in_args);
bc2ef884320bdc Mario Limonciello 2014-05-07 452 input.pointer = in_args;
b6f226670369d6 Colin Ian King 2019-03-30 453 if (out_data) {
bc2ef884320bdc Mario Limonciello 2014-05-07 454 output.length = ACPI_ALLOCATE_BUFFER;
bc2ef884320bdc Mario Limonciello 2014-05-07 455 output.pointer = NULL;
bc2ef884320bdc Mario Limonciello 2014-05-07 456 status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
bc2ef884320bdc Mario Limonciello 2014-05-07 457 command, &input, &output);
b6f226670369d6 Colin Ian King 2019-03-30 458 if (ACPI_SUCCESS(status)) {
bc2ef884320bdc Mario Limonciello 2014-05-07 459 obj = (union acpi_object *)output.pointer;
bc2ef884320bdc Mario Limonciello 2014-05-07 460 if (obj && obj->type == ACPI_TYPE_INTEGER)
bc2ef884320bdc Mario Limonciello 2014-05-07 461 *out_data = (u32)obj->integer.value;
bc2ef884320bdc Mario Limonciello 2014-05-07 462 }
b6f226670369d6 Colin Ian King 2019-03-30 463 kfree(output.pointer);
b6f226670369d6 Colin Ian King 2019-03-30 464 } else {
b6f226670369d6 Colin Ian King 2019-03-30 465 status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
b6f226670369d6 Colin Ian King 2019-03-30 466 command, &input, NULL);
b6f226670369d6 Colin Ian King 2019-03-30 467 }
857260113eeb7c Mario Limonciello 2018-09-10 @468 kfree(output.pointer);
bc2ef884320bdc Mario Limonciello 2014-05-07 469 return status;
bc2ef884320bdc Mario Limonciello 2014-05-07 470 }
bc2ef884320bdc Mario Limonciello 2014-05-07 471
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 23980 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* [android-common:android-3.18 721/1128] drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer'
@ 2021-05-08 8:06 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2021-05-08 8:06 UTC (permalink / raw)
To: kbuild-all
[-- Attachment #1: Type: text/plain, Size: 3224 bytes --]
tree: https://android.googlesource.com/kernel/common android-3.18
head: 9fdc1e6e49cc95c97f3285176b0417101f5ee38e
commit: 857260113eeb7c145dd939728eca0477394248f5 [721/1128] platform/x86: alienware-wmi: Correct a memory leak
config: x86_64-randconfig-m001-20210507 (attached as .config)
compiler: gcc-5 (Ubuntu 5.5.0-12ubuntu1) 5.5.0 20171010
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer'
vim +468 drivers/platform/x86/alienware-wmi.c
bc2ef884320bdc Mario Limonciello 2014-05-07 443 static acpi_status alienware_hdmi_command(struct hdmi_args *in_args,
bc2ef884320bdc Mario Limonciello 2014-05-07 444 u32 command, int *out_data)
a46ad0f13bc32a Mario Limonciello 2014-04-04 445 {
a46ad0f13bc32a Mario Limonciello 2014-04-04 446 acpi_status status;
a46ad0f13bc32a Mario Limonciello 2014-04-04 447 union acpi_object *obj;
bc2ef884320bdc Mario Limonciello 2014-05-07 448 struct acpi_buffer input;
bc2ef884320bdc Mario Limonciello 2014-05-07 449 struct acpi_buffer output;
bc2ef884320bdc Mario Limonciello 2014-05-07 450
bc2ef884320bdc Mario Limonciello 2014-05-07 451 input.length = (acpi_size) sizeof(*in_args);
bc2ef884320bdc Mario Limonciello 2014-05-07 452 input.pointer = in_args;
b6f226670369d6 Colin Ian King 2019-03-30 453 if (out_data) {
bc2ef884320bdc Mario Limonciello 2014-05-07 454 output.length = ACPI_ALLOCATE_BUFFER;
bc2ef884320bdc Mario Limonciello 2014-05-07 455 output.pointer = NULL;
bc2ef884320bdc Mario Limonciello 2014-05-07 456 status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
bc2ef884320bdc Mario Limonciello 2014-05-07 457 command, &input, &output);
b6f226670369d6 Colin Ian King 2019-03-30 458 if (ACPI_SUCCESS(status)) {
bc2ef884320bdc Mario Limonciello 2014-05-07 459 obj = (union acpi_object *)output.pointer;
bc2ef884320bdc Mario Limonciello 2014-05-07 460 if (obj && obj->type == ACPI_TYPE_INTEGER)
bc2ef884320bdc Mario Limonciello 2014-05-07 461 *out_data = (u32)obj->integer.value;
bc2ef884320bdc Mario Limonciello 2014-05-07 462 }
b6f226670369d6 Colin Ian King 2019-03-30 463 kfree(output.pointer);
^^^^^^^^^^^^^^^^^^^^^
Freed
b6f226670369d6 Colin Ian King 2019-03-30 464 } else {
b6f226670369d6 Colin Ian King 2019-03-30 465 status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
b6f226670369d6 Colin Ian King 2019-03-30 466 command, &input, NULL);
b6f226670369d6 Colin Ian King 2019-03-30 467 }
857260113eeb7c Mario Limonciello 2018-09-10 @468 kfree(output.pointer);
^^^^^^^^^^^^^^^^^^^^^
Double freed.
bc2ef884320bdc Mario Limonciello 2014-05-07 469 return status;
bc2ef884320bdc Mario Limonciello 2014-05-07 470 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-05-08 8:06 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-05-07 19:32 [android-common:android-3.18 721/1128] drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of 'output.pointer' kernel test robot
2021-05-08 8:06 ` Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.