Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d1dd0c23 authored by Paulo Marques's avatar Paulo Marques Committed by Len Brown
Browse files

[ACPI] fix kmalloc size bug in acpi/video.c 



acpi_video_device_find_cap() used &p instead of *p
when calculating storage size, thus allocating
only 4 or 8 bytes instead of 12...

Also, kfree(NULL) is legal, so remove some unneeded checks.

From: Paulo Marques <pmarques@grupopie.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLen Brown <len.brown@intel.com>
parent 7334571f

drivers/acpi/video.c

+6 −7
Original line number Original line Diff line number Diff line
@@ -564,12 +564,13 @@ acpi_video_device_find_cap (struct acpi_video_device *device) 
		int count = 0;

		int count = 0;

		union acpi_object *o;

		union acpi_object *o;

		

		

		br = kmalloc(sizeof &br, GFP_KERNEL);

		br = kmalloc(sizeof(*br), GFP_KERNEL);

		if (!br) {

		if (!br) {

			printk(KERN_ERR "can't allocate memory\n");

			printk(KERN_ERR "can't allocate memory\n");

		} else {

		} else {

			memset(br, 0, sizeof &br);

			memset(br, 0, sizeof(*br));

			br->levels = kmalloc(obj->package.count * sizeof &br->levels, GFP_KERNEL);

			br->levels = kmalloc(obj->package.count *

					sizeof *(br->levels), GFP_KERNEL);

			if (!br->levels)

			if (!br->levels)

				goto out;

				goto out;
@@ -584,7 +585,6 @@ acpi_video_device_find_cap (struct acpi_video_device *device) 
			}

			}

out:

out:

			if (count < 2) {

			if (count < 2) {

				if (br->levels)

				kfree(br->levels);

				kfree(br->levels);

				kfree(br);

				kfree(br);

			} else {

			} else {
@@ -595,7 +595,6 @@ out: 
		}

		}

	}

	}





	if (obj)

	kfree(obj);

	kfree(obj);





	return_VOID;

	return_VOID;