thinkpad_acpi: fix possible NULL pointer dereference if kstrdup for ec_version_str failed

thinkpad_acpi: fix possible NULL pointer dereference if kstrdup for ec_version_str failed

[Jan Lieskovsky]

[-- Attachment #1: Type: text/plain, Size: 369 bytes --]

Hello guys,

  apologize for bothering you if wrong, but based on patch from Cyrill:

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=90fe17f4df2f830601ffd422b11d1f7f9a9d0355

There is a potential NULL pointer dereference in thinkpad_acpi_module_exit() -- in case,
kstrdup for thinkpad_id.ec_version_str failed.

Kind regards
Jan Lieskovsky

[-- Attachment #2: kstrdup_ec_version_str.patch --]
[-- Type: text/x-patch, Size: 442 bytes --]

--- linux-2.6.25.3.old/drivers/misc/thinkpad_acpi.c	2008-05-12 11:43:16.000000000 +0200
+++ linux-2.6.25.3/drivers/misc/thinkpad_acpi.c	2008-05-16 11:20:48.000000000 +0200
@@ -6072,7 +6072,8 @@
 		remove_proc_entry(TPACPI_PROC_DIR, acpi_root_dir);
 
 	kfree(thinkpad_id.bios_version_str);
-	kfree(thinkpad_id.ec_version_str);
+	if (thinkpad_id.ec_version_str)	
+	      	kfree(thinkpad_id.ec_version_str);
 	kfree(thinkpad_id.model_str);
 }
 

Re: thinkpad_acpi: fix possible NULL pointer dereference if kstrdup for ec_version_str failed

[Henrique de Moraes Holschuh]

On Fri, 16 May 2008 11:34:09 +0200, "Jan Lieskovsky" <jlieskov@redhat.com> said:
> There is a potential NULL pointer dereference in
> thinkpad_acpi_module_exit() -- in case,
> kstrdup for thinkpad_id.ec_version_str failed.

One can kfree(NULL) without problems.  Is there any other unprotected access to ec_version_str that I failed to see?

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh