linux-kernel - [PATCH v2 1/1] platform/x86: surface3-wmi: Balance locking on error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20161215174106.13916-1-andriy.shevchenko@linux.intel.com>
Date:   Thu, 15 Dec 2016 19:41:06 +0200
From:   Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To:     linux-kernel@...r.kernel.org
Cc:     Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Darren Hart <dvhart@...radead.org>,
        platform-driver-x86@...r.kernel.org
Subject: [PATCH v2 1/1] platform/x86: surface3-wmi: Balance locking on error path

There is a possibility that lock will be left acquired.
Consolidate error path under out_free_unlock label.

Reported-by: kbuild test robot <fengguang.wu@...el.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@...hat.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
---
In v2:
- address Darren's comments
- update tags (in particular put proper email of reporter)

I dare to push this to testing ahead. If anyone has objections, tell me asap.

 drivers/platform/x86/surface3-wmi.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/platform/x86/surface3-wmi.c b/drivers/platform/x86/surface3-wmi.c
index 5553b2b85e0a..cbf4d83a7271 100644
--- a/drivers/platform/x86/surface3-wmi.c
+++ b/drivers/platform/x86/surface3-wmi.c
@@ -60,10 +60,10 @@ static DEFINE_MUTEX(s3_wmi_lock);
 
 static int s3_wmi_query_block(const char *guid, int instance, int *ret)
 {
+	struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
 	acpi_status status;
 	union acpi_object *obj;
-
-	struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+	int error = 0;
 
 	mutex_lock(&s3_wmi_lock);
 	status = wmi_query_block(guid, instance, &output);
@@ -77,13 +77,14 @@ static int s3_wmi_query_block(const char *guid, int instance, int *ret)
 			       obj->type == ACPI_TYPE_BUFFER ?
 						obj->buffer.length : 0);
 		}
-		kfree(obj);
-		return -EINVAL;
+		error = -EINVAL;
+		goto out_free_unlock;
 	}
 	*ret = obj->integer.value;
+ out_free_unlock:
 	kfree(obj);
 	mutex_unlock(&s3_wmi_lock);
-	return 0;
+	return error;
 }
 
 static inline int s3_wmi_query_lid(int *ret)
-- 
2.11.0