From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A070C33CB3 for ; Thu, 16 Jan 2020 17:26:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D6543246D7 for ; Thu, 16 Jan 2020 17:26:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1579195592; bh=00b8VWgnfkcFnME6wpnUkkx2fSb1zkuDu3bJITKvyQQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=IdH21h1EpbDk87POVjO3xC7plUCcyp6xf0dP68UTY0uw7/UB8bPdQsegLax8sXed9 /AgKPDLstgdJoH1dDr0KckKYG8OZEQbZoirnkN4mqHBxhQuU62NEpJIaHbB3MffT6h yUUQ47A2P7IVaZfrQwcxlb8LYma0SW5fgaHkvaAw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2392307AbgAPR0a (ORCPT ); Thu, 16 Jan 2020 12:26:30 -0500 Received: from mail.kernel.org ([198.145.29.99]:35076 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2403921AbgAPR0W (ORCPT ); Thu, 16 Jan 2020 12:26:22 -0500 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 72B24246C9; Thu, 16 Jan 2020 17:26:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1579195582; bh=00b8VWgnfkcFnME6wpnUkkx2fSb1zkuDu3bJITKvyQQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jeldqMrE+NbGSUq0Mc9gkEFUKaaS9NFAhmTB+LK5vF71U1TloCGvVJ9INFQduqqdr eOP19PB2HH0ZiMgcmV+MPciEc06rknac3PK9BjQBYarkATAhOXC+YmTXM7ACLeP7tJ o3naoIgWXYul9vuCrpl3MkZ9Tzwx89x9mVJQJCM8= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Colin Ian King , Darren Hart , Sasha Levin , platform-driver-x86@vger.kernel.org Subject: [PATCH AUTOSEL 4.14 163/371] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer Date: Thu, 16 Jan 2020 12:20:35 -0500 Message-Id: <20200116172403.18149-106-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200116172403.18149-1-sashal@kernel.org> References: <20200116172403.18149-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King [ Upstream commit 98e2630284ab741804bd0713e932e725466f2f84 ] Currently the kfree of output.pointer can be potentially freeing an uninitalized pointer in the case where out_data is NULL. Fix this by reworking the case where out_data is not-null to perform the ACPI status check and also the kfree of outpoint.pointer in one block and hence ensuring the pointer is only freed when it has been used. Also replace the if (ptr != NULL) idiom with just if (ptr). Fixes: ff0e9f26288d ("platform/x86: alienware-wmi: Correct a memory leak") Signed-off-by: Colin Ian King Signed-off-by: Darren Hart (VMware) Signed-off-by: Sasha Levin --- drivers/platform/x86/alienware-wmi.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c index e335b18da20f..cbd84e2e3bd4 100644 --- a/drivers/platform/x86/alienware-wmi.c +++ b/drivers/platform/x86/alienware-wmi.c @@ -505,23 +505,22 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args, input.length = (acpi_size) sizeof(*in_args); input.pointer = in_args; - if (out_data != NULL) { + if (out_data) { output.length = ACPI_ALLOCATE_BUFFER; output.pointer = NULL; status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0, command, &input, &output); - } else + if (ACPI_SUCCESS(status)) { + obj = (union acpi_object *)output.pointer; + if (obj && obj->type == ACPI_TYPE_INTEGER) + *out_data = (u32)obj->integer.value; + } + kfree(output.pointer); + } else { status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0, command, &input, NULL); - - if (ACPI_SUCCESS(status) && out_data != NULL) { - obj = (union acpi_object *)output.pointer; - if (obj && obj->type == ACPI_TYPE_INTEGER) - *out_data = (u32) obj->integer.value; } - kfree(output.pointer); return status; - } /* -- 2.20.1