From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Lee, Chun-Yi" Subject: [PATCH 2/3] acer-wmi: fix obj is NULL but dereferenced Date: Tue, 25 Sep 2012 14:40:55 +0800 Message-ID: <1348555256-13129-2-git-send-email-jlee@suse.com> References: <1348555256-13129-1-git-send-email-jlee@suse.com> Return-path: Received: from mail-qc0-f174.google.com ([209.85.216.174]:55349 "EHLO mail-qc0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751773Ab2IYGrW (ORCPT ); Tue, 25 Sep 2012 02:47:22 -0400 Received: by qcro28 with SMTP id o28so4996866qcr.19 for ; Mon, 24 Sep 2012 23:47:21 -0700 (PDT) In-Reply-To: <1348555256-13129-1-git-send-email-jlee@suse.com> Sender: platform-driver-x86-owner@vger.kernel.org List-ID: To: mjg@redhat.com Cc: platform-driver-x86@vger.kernel.org, "Lee, Chun-Yi" , Carlos Corbacho , Dmitry Torokhov , Corentin Chary , Thomas Renninger Fengguang Wu run coccinelle and warns about: drivers/platform/x86/acer-wmi.c:1200:17-21: ERROR: obj is NULL but dereferenced. drivers/platform/x86/acer-wmi.c:891:17-21: ERROR: obj is NULL but dereferenced. drivers/platform/x86/acer-wmi.c:1953:17-21: ERROR: obj is NULL but dereferenced. It causes by the code in patch 987dfbaa65b2c3568b85e29d2598da08a011ee09 doesn't check obj variable should not be NULL. There have risk for dereference a NULL obj, so add this patch to fix. Cc: Carlos Corbacho Cc: Matthew Garrett Cc: Dmitry Torokhov Cc: Corentin Chary Cc: Thomas Renninger Signed-off-by: Lee, Chun-Yi --- drivers/platform/x86/acer-wmi.c | 46 +++++++++++++++++++++----------------- 1 files changed, 25 insertions(+), 21 deletions(-) diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c index 00d8c39..5ff493e 100644 --- a/drivers/platform/x86/acer-wmi.c +++ b/drivers/platform/x86/acer-wmi.c @@ -884,7 +884,7 @@ WMI_execute_u32(u32 method_id, u32 in, u32 *out) struct acpi_buffer input = { (acpi_size) sizeof(u32), (void *)(&in) }; struct acpi_buffer result = { ACPI_ALLOCATE_BUFFER, NULL }; union acpi_object *obj; - u32 tmp; + u32 tmp = 0; acpi_status status; status = wmi_evaluate_method(WMID_GUID1, 1, method_id, &input, &result); @@ -893,14 +893,14 @@ WMI_execute_u32(u32 method_id, u32 in, u32 *out) return status; obj = (union acpi_object *) result.pointer; - if (obj && obj->type == ACPI_TYPE_BUFFER && - (obj->buffer.length == sizeof(u32) || - obj->buffer.length == sizeof(u64))) { - tmp = *((u32 *) obj->buffer.pointer); - } else if (obj->type == ACPI_TYPE_INTEGER) { - tmp = (u32) obj->integer.value; - } else { - tmp = 0; + if (obj) { + if (obj->type == ACPI_TYPE_BUFFER && + (obj->buffer.length == sizeof(u32) || + obj->buffer.length == sizeof(u64))) { + tmp = *((u32 *) obj->buffer.pointer); + } else if (obj->type == ACPI_TYPE_INTEGER) { + tmp = (u32) obj->integer.value; + } } if (out) @@ -1202,12 +1202,14 @@ static acpi_status WMID_set_capabilities(void) return status; obj = (union acpi_object *) out.pointer; - if (obj && obj->type == ACPI_TYPE_BUFFER && - (obj->buffer.length == sizeof(u32) || - obj->buffer.length == sizeof(u64))) { - devices = *((u32 *) obj->buffer.pointer); - } else if (obj->type == ACPI_TYPE_INTEGER) { - devices = (u32) obj->integer.value; + if (obj) { + if (obj->type == ACPI_TYPE_BUFFER && + (obj->buffer.length == sizeof(u32) || + obj->buffer.length == sizeof(u64))) { + devices = *((u32 *) obj->buffer.pointer); + } else if (obj->type == ACPI_TYPE_INTEGER) { + devices = (u32) obj->integer.value; + } } else { kfree(out.pointer); return AE_ERROR; @@ -1955,12 +1957,14 @@ static u32 get_wmid_devices(void) return 0; obj = (union acpi_object *) out.pointer; - if (obj && obj->type == ACPI_TYPE_BUFFER && - (obj->buffer.length == sizeof(u32) || - obj->buffer.length == sizeof(u64))) { - devices = *((u32 *) obj->buffer.pointer); - } else if (obj->type == ACPI_TYPE_INTEGER) { - devices = (u32) obj->integer.value; + if (obj) { + if (obj->type == ACPI_TYPE_BUFFER && + (obj->buffer.length == sizeof(u32) || + obj->buffer.length == sizeof(u64))) { + devices = *((u32 *) obj->buffer.pointer); + } else if (obj->type == ACPI_TYPE_INTEGER) { + devices = (u32) obj->integer.value; + } } kfree(out.pointer); -- 1.6.0.2