Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f20aaba9 authored by Lee, Chun-Yi's avatar Lee, Chun-Yi Committed by Matthew Garrett
Browse files

acer-wmi: fix obj is NULL but dereferenced 



Fengguang Wu run coccinelle and warns about:
  drivers/platform/x86/acer-wmi.c:1200:17-21: ERROR: obj is NULL but dereferenced.
  drivers/platform/x86/acer-wmi.c:891:17-21: ERROR: obj is NULL but dereferenced.
  drivers/platform/x86/acer-wmi.c:1953:17-21: ERROR: obj is NULL but dereferenced.

It causes by the code in patch 987dfbaa doesn't check
obj variable should not be NULL. There have risk for dereference a NULL obj, so add
this patch to fix.

Cc: Carlos Corbacho <carlos@strangeworlds.co.uk>
Cc: Matthew Garrett <mjg@redhat.com>
Cc: Dmitry Torokhov <dtor@mail.ru>
Cc: Corentin Chary <corentincj@iksaif.net>
Cc: Thomas Renninger <trenn@suse.de>
Signed-off-by: default avatarLee, Chun-Yi <jlee@suse.com>
Signed-off-by: default avatarMatthew Garrett <matthew.garrett@nebula.com>
parent 182ae55c

drivers/platform/x86/acer-wmi.c

+25 −21
Original line number Diff line number Diff line
@@ -875,7 +875,7 @@ WMI_execute_u32(u32 method_id, u32 in, u32 *out) 
	struct acpi_buffer input = { (acpi_size) sizeof(u32), (void *)(&in) };

	struct acpi_buffer result = { ACPI_ALLOCATE_BUFFER, NULL };

	union acpi_object *obj;

	u32 tmp;

	u32 tmp = 0;

	acpi_status status;



	status = wmi_evaluate_method(WMID_GUID1, 1, method_id, &input, &result);
@@ -884,14 +884,14 @@ WMI_execute_u32(u32 method_id, u32 in, u32 *out) 
		return status;



	obj = (union acpi_object *) result.pointer;

	if (obj && obj->type == ACPI_TYPE_BUFFER &&

	if (obj) {

		if (obj->type == ACPI_TYPE_BUFFER &&

			(obj->buffer.length == sizeof(u32) ||

			obj->buffer.length == sizeof(u64))) {

			tmp = *((u32 *) obj->buffer.pointer);

		} else if (obj->type == ACPI_TYPE_INTEGER) {

			tmp = (u32) obj->integer.value;

	} else {

		tmp = 0;

		}

	}



	if (out)
@@ -1193,12 +1193,14 @@ static acpi_status WMID_set_capabilities(void) 
		return status;



	obj = (union acpi_object *) out.pointer;

	if (obj && obj->type == ACPI_TYPE_BUFFER &&

	if (obj) {

		if (obj->type == ACPI_TYPE_BUFFER &&

			(obj->buffer.length == sizeof(u32) ||

			obj->buffer.length == sizeof(u64))) {

			devices = *((u32 *) obj->buffer.pointer);

		} else if (obj->type == ACPI_TYPE_INTEGER) {

			devices = (u32) obj->integer.value;

		}

	} else {

		kfree(out.pointer);

		return AE_ERROR;
@@ -1946,13 +1948,15 @@ static u32 get_wmid_devices(void) 
		return 0;



	obj = (union acpi_object *) out.pointer;

	if (obj && obj->type == ACPI_TYPE_BUFFER &&

	if (obj) {

		if (obj->type == ACPI_TYPE_BUFFER &&

			(obj->buffer.length == sizeof(u32) ||

			obj->buffer.length == sizeof(u64))) {

			devices = *((u32 *) obj->buffer.pointer);

		} else if (obj->type == ACPI_TYPE_INTEGER) {

			devices = (u32) obj->integer.value;

		}

	}



	kfree(out.pointer);

	return devices;