Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 66904863 authored by Axel Lin's avatar Axel Lin Committed by Matthew Garrett
Browse files

acer-wmi: fix memory leaks in WMID_set_capabilities and get_wmid_devices 



When acpi_evaluate_object() is passed ACPI_ALLOCATE_BUFFER, the caller
must kfree the returned buffer if AE_OK is returned.

The callers of wmi_query_block() pass ACPI_ALLOCATE_BUFFER, and thus must
check its return value before accessing or kfree() on the buffer.

This patch adds a missing kfree(out.pointer) before exit
WMID_set_capabilities() and get_wmid_devices().

Signed-off-by: default avatarAxel Lin <axel.lin@gmail.com>
Acked-by: default avatarCarlos Corbacho <carlos@strangeworlds.co.uk>
Cc: Matthew Garrett <mjg@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarMatthew Garrett <mjg@redhat.com>
parent f8ef3aec

drivers/platform/x86/acer-wmi.c

+7 −3
Original line number Diff line number Diff line
@@ -772,6 +772,7 @@ static acpi_status WMID_set_capabilities(void) 
		obj->buffer.length == sizeof(u32)) {

		devices = *((u32 *) obj->buffer.pointer);

	} else {

		kfree(out.pointer);

		return AE_ERROR;

	}
@@ -788,6 +789,7 @@ static acpi_status WMID_set_capabilities(void) 
	if (!(devices & 0x20))

		max_brightness = 0x9;



	kfree(out.pointer);

	return status;

}
@@ -1094,6 +1096,7 @@ static u32 get_wmid_devices(void) 
	struct acpi_buffer out = {ACPI_ALLOCATE_BUFFER, NULL};

	union acpi_object *obj;

	acpi_status status;

	u32 devices = 0;



	status = wmi_query_block(WMID_GUID2, 1, &out);

	if (ACPI_FAILURE(status))
@@ -1102,10 +1105,11 @@ static u32 get_wmid_devices(void) 
	obj = (union acpi_object *) out.pointer;

	if (obj && obj->type == ACPI_TYPE_BUFFER &&

		obj->buffer.length == sizeof(u32)) {

		return *((u32 *) obj->buffer.pointer);

	} else {

		return 0;

		devices = *((u32 *) obj->buffer.pointer);

	}



	kfree(out.pointer);

	return devices;

}



/*