diff options
| author | Axel Lin <axel.lin@gmail.com> | 2010-07-20 15:19:52 -0700 |
|---|---|---|
| committer | Matthew Garrett <mjg@redhat.com> | 2010-08-03 09:49:03 -0400 |
| commit | 669048639ca6d3fdfb2e75dd77b8f49434d57625 (patch) | |
| tree | 86a30799d2a76d1913b3ca9116bead864732cf49 | |
| parent | f8ef3aecabe0e386303d028d02b6e5b23ac3a566 (diff) | |
acer-wmi: fix memory leaks in WMID_set_capabilities and get_wmid_devices
When acpi_evaluate_object() is passed ACPI_ALLOCATE_BUFFER, the caller
must kfree the returned buffer if AE_OK is returned.
The callers of wmi_query_block() pass ACPI_ALLOCATE_BUFFER, and thus must
check its return value before accessing or kfree() on the buffer.
This patch adds a missing kfree(out.pointer) before exit
WMID_set_capabilities() and get_wmid_devices().
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Carlos Corbacho <carlos@strangeworlds.co.uk>
Cc: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
| -rw-r--r-- | drivers/platform/x86/acer-wmi.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c index dec558ee29e..652ca1800a0 100644 --- a/drivers/platform/x86/acer-wmi.c +++ b/drivers/platform/x86/acer-wmi.c @@ -772,6 +772,7 @@ static acpi_status WMID_set_capabilities(void) obj->buffer.length == sizeof(u32)) { devices = *((u32 *) obj->buffer.pointer); } else { + kfree(out.pointer); return AE_ERROR; } @@ -788,6 +789,7 @@ static acpi_status WMID_set_capabilities(void) if (!(devices & 0x20)) max_brightness = 0x9; + kfree(out.pointer); return status; } @@ -1094,6 +1096,7 @@ static u32 get_wmid_devices(void) struct acpi_buffer out = {ACPI_ALLOCATE_BUFFER, NULL}; union acpi_object *obj; acpi_status status; + u32 devices = 0; status = wmi_query_block(WMID_GUID2, 1, &out); if (ACPI_FAILURE(status)) @@ -1102,10 +1105,11 @@ static u32 get_wmid_devices(void) obj = (union acpi_object *) out.pointer; if (obj && obj->type == ACPI_TYPE_BUFFER && obj->buffer.length == sizeof(u32)) { - return *((u32 *) obj->buffer.pointer); - } else { - return 0; + devices = *((u32 *) obj->buffer.pointer); } + + kfree(out.pointer); + return devices; } /* |