From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8E2E4C2D0DB for ; Fri, 24 Jan 2020 09:54:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 651CF2075D for ; Fri, 24 Jan 2020 09:54:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1579859672; bh=X92FrQQdcFrf/SaNRGaHJNaRL+FGFKOytOntdtpAkqw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=GmoAUTh4eP5sIxRPU/lk+4++GsCuDoCf7ojjgRqUKoE04R+mLp7MSzOdCDbR/N82i UFPNJdVEtlfhjLhf9gXDzsD94hT50N9nJtNTxoMyCXzU/3fltCtdSbrwg4Dt067OhY 0BXwfnV9DK+pW5MqH3RTTWgM9Jwryq5HsOeA84Xk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388373AbgAXJyb (ORCPT ); Fri, 24 Jan 2020 04:54:31 -0500 Received: from mail.kernel.org ([198.145.29.99]:57538 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731584AbgAXJy2 (ORCPT ); Fri, 24 Jan 2020 04:54:28 -0500 Received: from localhost (unknown [145.15.244.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 157512075D; Fri, 24 Jan 2020 09:54:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1579859667; bh=X92FrQQdcFrf/SaNRGaHJNaRL+FGFKOytOntdtpAkqw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zpbCHiJ7uA3uRGL9kzkDtIOzuFKYwYFlzZEPHffe9ICNcoRWadiO7WskXRiqJf3hS E42dem9FUiZ/a99Xu2zbQDiFpgTnP7z/1YtOSKq57EeJOcDan8h83MC+5/qqjTJq2/ m8jGztM6Lvi8ysUzTnLV3/QmqSc1HYVux0m2dglM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Colin Ian King , "Darren Hart (VMware)" , Sasha Levin Subject: [PATCH 4.14 169/343] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer Date: Fri, 24 Jan 2020 10:29:47 +0100 Message-Id: <20200124092942.237621910@linuxfoundation.org> X-Mailer: git-send-email 2.25.0 In-Reply-To: <20200124092919.490687572@linuxfoundation.org> References: <20200124092919.490687572@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King [ Upstream commit 98e2630284ab741804bd0713e932e725466f2f84 ] Currently the kfree of output.pointer can be potentially freeing an uninitalized pointer in the case where out_data is NULL. Fix this by reworking the case where out_data is not-null to perform the ACPI status check and also the kfree of outpoint.pointer in one block and hence ensuring the pointer is only freed when it has been used. Also replace the if (ptr != NULL) idiom with just if (ptr). Fixes: ff0e9f26288d ("platform/x86: alienware-wmi: Correct a memory leak") Signed-off-by: Colin Ian King Signed-off-by: Darren Hart (VMware) Signed-off-by: Sasha Levin --- drivers/platform/x86/alienware-wmi.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c index e335b18da20fc..cbd84e2e3bd47 100644 --- a/drivers/platform/x86/alienware-wmi.c +++ b/drivers/platform/x86/alienware-wmi.c @@ -505,23 +505,22 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args, input.length = (acpi_size) sizeof(*in_args); input.pointer = in_args; - if (out_data != NULL) { + if (out_data) { output.length = ACPI_ALLOCATE_BUFFER; output.pointer = NULL; status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0, command, &input, &output); - } else + if (ACPI_SUCCESS(status)) { + obj = (union acpi_object *)output.pointer; + if (obj && obj->type == ACPI_TYPE_INTEGER) + *out_data = (u32)obj->integer.value; + } + kfree(output.pointer); + } else { status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0, command, &input, NULL); - - if (ACPI_SUCCESS(status) && out_data != NULL) { - obj = (union acpi_object *)output.pointer; - if (obj && obj->type == ACPI_TYPE_INTEGER) - *out_data = (u32) obj->integer.value; } - kfree(output.pointer); return status; - } /* -- 2.20.1