Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e85dbe4 authored by Crestez Dan Leonard's avatar Crestez Dan Leonard Committed by Jonathan Cameron
Browse files

iio: inv_mpu6050: Fix use-after-free in ACPI code 



In some cases this can result in incorrectly returning a negative value
from asus_acpi_get_sensor_info and the AK8963 magnetometer failing to
show up.

Note cpm is an alias for buffer.pointer which isn't apparent in this
patch on it's own.

Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: default avatarCrestez Dan Leonard <leonard.crestez@intel.com>
Acked-by: default avatarDaniel Baluta <daniel.baluta@intel.com>
Signed-off-by: default avatarJonathan Cameron <jic23@kernel.org>
parent a9cc4006

drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c

+3 −2
Original line number Diff line number Diff line
@@ -56,6 +56,7 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev, 
	int i;

	acpi_status status;

	union acpi_object *cpm;

	int ret;



	status = acpi_evaluate_object(adev->handle, "CNF0", NULL, &buffer);

	if (ACPI_FAILURE(status))
@@ -82,10 +83,10 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev, 
			}

		}

	}



	ret = cpm->package.count;

	kfree(buffer.pointer);



	return cpm->package.count;

	return ret;

}



static int acpi_i2c_check_resource(struct acpi_resource *ares, void *data)