linux-kernel - [PATCH v2 2/4] ACPI / EC: Fix a memory leakage issue in acpi_ec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <2a0e9a11d5e16d4775a45773c94067a8d3ea98c1.1473238007.git.lv.zheng@intel.com>
Date:   Wed,  7 Sep 2016 16:50:14 +0800
From:   Lv Zheng <lv.zheng@...el.com>
To:     "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
        "Rafael J. Wysocki" <rjw@...ysocki.net>,
        Len Brown <len.brown@...el.com>
Cc:     Lv Zheng <lv.zheng@...el.com>, Lv Zheng <zetalog@...il.com>,
        <linux-kernel@...r.kernel.org>, linux-acpi@...r.kernel.org,
        Peter Wu <peter@...ensteyn.nl>
Subject: [PATCH v2 2/4] ACPI / EC: Fix a memory leakage issue in acpi_ec_add()

When the handler installation failed, there was no code to free the
allocated EC device. This patch fixes this memory leakage issue.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=115021
Reported-and-tested-by: Luya Tshimbalanga <luya@...oraproject.org>
Tested-by: Jonh Henderson <jw.hendy@...il.com>
Signed-off-by: Lv Zheng <lv.zheng@...el.com>
Cc: Peter Wu <peter@...ensteyn.nl>
---
 drivers/acpi/ec.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 9eab651..50895ff 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1513,14 +1513,18 @@ static int acpi_ec_add(struct acpi_device *device)
 		return -ENOMEM;
 	if (ec_parse_device(device->handle, 0, ec, NULL) !=
 		AE_CTRL_TERMINATE) {
-			acpi_ec_free(ec);
-			return -EINVAL;
+			ret = -EINVAL;
+			goto err_alloc;
 	}
 
 	/* Find and register all query methods */
 	acpi_walk_namespace(ACPI_TYPE_METHOD, ec->handle, 1,
 			    acpi_ec_register_query_methods, NULL, ec, NULL);
 
+	ret = acpi_config_boot_ec(ec, false);
+	if (ret)
+		goto err_query;
+
 	device->driver_data = ec;
 
 	ret = !!request_region(ec->data_addr, 1, "EC data");
@@ -1528,13 +1532,17 @@ static int acpi_ec_add(struct acpi_device *device)
 	ret = !!request_region(ec->command_addr, 1, "EC cmd");
 	WARN(!ret, "Could not request EC cmd io port 0x%lx", ec->command_addr);
 
-	ret = acpi_config_boot_ec(ec, false);
-
 	/* Reprobe devices depending on the EC */
 	acpi_walk_dep_device_list(ec->handle);
 
 	/* EC is fully operational, allow queries */
 	acpi_ec_enable_event(ec);
+	return 0;
+
+err_query:
+	acpi_ec_remove_query_handlers(ec, true, 0);
+err_alloc:
+	acpi_ec_free(ec);
 	return ret;
 }
 
-- 
1.7.10