From 3e9b988e4edf065d39c1343937f717319b1c1065 Mon Sep 17 00:00:00 2001 From: Anisse Astier Date: Fri, 4 Dec 2009 10:10:09 +0100 Subject: wmi: Free the allocated acpi objects through wmi_get_event_data These function allocate an acpi object by calling wmi_get_event_data, which then calls acpi_evaluate_object, and it is not freed afterwards. And kernel doc is fixed for parameters of wmi_get_event_data. Signed-off-by: Anisse Astier Acked-by: Randy Dunlap Acked-by: Carlos Corbacho Signed-off-by: Len Brown --- drivers/platform/x86/hp-wmi.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/platform/x86/hp-wmi.c') diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c index 63c3e658a88..db10c5d007e 100644 --- a/drivers/platform/x86/hp-wmi.c +++ b/drivers/platform/x86/hp-wmi.c @@ -381,6 +381,8 @@ static void hp_wmi_notify(u32 value, void *context) } else printk(KERN_INFO "HP WMI: Unknown key pressed - %x\n", eventcode); + + kfree(obj); } static int __init hp_wmi_input_setup(void) -- cgit v1.2.3-70-g09d2 From 44ef00e6482e755f36629773abc2aee83a6f53e3 Mon Sep 17 00:00:00 2001 From: Thomas Renninger Date: Fri, 18 Dec 2009 15:29:23 +0100 Subject: hp-wmi: Fix two memleaks Signed-off-by: Thomas Renninger Signed-off-by: Len Brown --- drivers/platform/x86/hp-wmi.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'drivers/platform/x86/hp-wmi.c') diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c index db10c5d007e..8781d8fa7a5 100644 --- a/drivers/platform/x86/hp-wmi.c +++ b/drivers/platform/x86/hp-wmi.c @@ -134,10 +134,15 @@ static int hp_wmi_perform_query(int query, int write, int value) obj = output.pointer; - if (!obj || obj->type != ACPI_TYPE_BUFFER) + if (!obj) return -EINVAL; + else if (obj->type != ACPI_TYPE_BUFFER) { + kfree(obj); + return -EINVAL; + } bios_return = *((struct bios_return *)obj->buffer.pointer); + kfree(obj); if (bios_return.return_code > 0) return bios_return.return_code * -1; else @@ -340,10 +345,12 @@ static void hp_wmi_notify(u32 value, void *context) if (!obj || obj->type != ACPI_TYPE_BUFFER || obj->buffer.length != 8) { printk(KERN_INFO "HP WMI: Unknown response received\n"); + kfree(obj); return; } eventcode = *((u8 *) obj->buffer.pointer); + kfree(obj); if (eventcode == 0x4) eventcode = hp_wmi_perform_query(HPWMI_HOTKEY_QUERY, 0, 0); -- cgit v1.2.3-70-g09d2 From f27725756be8a2c2dc65eaf70d0b52807aa2f113 Mon Sep 17 00:00:00 2001 From: Len Brown Date: Sat, 26 Dec 2009 22:04:03 -0500 Subject: ACPI: hp-wmi, msi-wmi: clarify that wmi_install_notify_handler() returns an acpi_status Emphasize that that wmi_install_notify_handler() returns an acpi_status rather than -errno by by testing ACPI_SUCCESS(), ACPI_FAILURE(). No functional change in this patch, but this confusion caused a bug in dell-wmi. Signed-off-by: Len Brown --- drivers/platform/x86/hp-wmi.c | 2 +- drivers/platform/x86/msi-wmi.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/platform/x86/hp-wmi.c') diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c index 8781d8fa7a5..18bf74136d2 100644 --- a/drivers/platform/x86/hp-wmi.c +++ b/drivers/platform/x86/hp-wmi.c @@ -581,7 +581,7 @@ static int __init hp_wmi_init(void) if (wmi_has_guid(HPWMI_EVENT_GUID)) { err = wmi_install_notify_handler(HPWMI_EVENT_GUID, hp_wmi_notify, NULL); - if (!err) + if (ACPI_SUCCESS(err)) hp_wmi_input_setup(); } diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c index 7f77f908bb0..f746c677ada 100644 --- a/drivers/platform/x86/msi-wmi.c +++ b/drivers/platform/x86/msi-wmi.c @@ -236,7 +236,7 @@ static int __init msi_wmi_init(void) } err = wmi_install_notify_handler(MSIWMI_EVENT_GUID, msi_wmi_notify, NULL); - if (err) + if (ACPI_FAILURE(err)) return -EINVAL; err = msi_wmi_input_setup(); -- cgit v1.2.3-70-g09d2 From fda11e61ff8a4e3a8ebbd434e46560b67cc0ca9d Mon Sep 17 00:00:00 2001 From: Len Brown Date: Sat, 26 Dec 2009 23:02:24 -0500 Subject: dell-wmi, hp-wmi, msi-wmi: check wmi_get_event_data() return value When acpi_evaluate_object() is passed ACPI_ALLOCATE_BUFFER, the caller must kfree the returned buffer if AE_OK is returned. The callers of wmi_get_event_data() pass ACPI_ALLOCATE_BUFFER, and thus must check its return value before accessing or kfree() on the buffer. Signed-off-by: Len Brown --- drivers/platform/x86/dell-wmi.c | 7 ++++++- drivers/platform/x86/hp-wmi.c | 7 ++++++- drivers/platform/x86/msi-wmi.c | 7 ++++++- 3 files changed, 18 insertions(+), 3 deletions(-) (limited to 'drivers/platform/x86/hp-wmi.c') diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c index 4c7e70299d6..500af8c9ada 100644 --- a/drivers/platform/x86/dell-wmi.c +++ b/drivers/platform/x86/dell-wmi.c @@ -202,8 +202,13 @@ static void dell_wmi_notify(u32 value, void *context) struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL }; static struct key_entry *key; union acpi_object *obj; + acpi_status status; - wmi_get_event_data(value, &response); + status = wmi_get_event_data(value, &response); + if (status != AE_OK) { + printk(KERN_INFO "dell-wmi: bad event status 0x%x\n", status); + return; + } obj = (union acpi_object *)response.pointer; diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c index 18bf74136d2..5b648f0c607 100644 --- a/drivers/platform/x86/hp-wmi.c +++ b/drivers/platform/x86/hp-wmi.c @@ -338,8 +338,13 @@ static void hp_wmi_notify(u32 value, void *context) static struct key_entry *key; union acpi_object *obj; int eventcode; + acpi_status status; - wmi_get_event_data(value, &response); + status = wmi_get_event_data(value, &response); + if (status != AE_OK) { + printk(KERN_INFO "hp-wmi: bad event status 0x%x\n", status); + return; + } obj = (union acpi_object *)response.pointer; diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c index f746c677ada..f5f70d4c691 100644 --- a/drivers/platform/x86/msi-wmi.c +++ b/drivers/platform/x86/msi-wmi.c @@ -149,8 +149,13 @@ static void msi_wmi_notify(u32 value, void *context) static struct key_entry *key; union acpi_object *obj; ktime_t cur; + acpi_status status; - wmi_get_event_data(value, &response); + status = wmi_get_event_data(value, &response); + if (status != AE_OK) { + printk(KERN_INFO DRV_PFX "bad event status 0x%x\n", status); + return; + } obj = (union acpi_object *)response.pointer; -- cgit v1.2.3-70-g09d2 From c9c041fcb1a4d69ed4791f00b57554eeb341d148 Mon Sep 17 00:00:00 2001 From: Anisse Astier Date: Thu, 31 Dec 2009 16:41:33 +0100 Subject: hp-wmi: remove double free caused by merge conflict Commit 3e9b988e4edf065d39c1343937f717319b1c1065 "wmi: Free the allocated acpi objects through wmi_get_event_data" had the same purpose as commit 44ef00e6482e755f36629773abc2aee83a6f53e3 "hp-wmi: Fix two memleaks" This should solve this regression: http://bugzilla.kernel.org/show_bug.cgi?id=14890 Signed-off-by: Anisse Astier Reported-by: Sedat Dilek Signed-off-by: Len Brown --- drivers/platform/x86/hp-wmi.c | 2 -- 1 file changed, 2 deletions(-) (limited to 'drivers/platform/x86/hp-wmi.c') diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c index 5b648f0c607..ad4c414dbfb 100644 --- a/drivers/platform/x86/hp-wmi.c +++ b/drivers/platform/x86/hp-wmi.c @@ -393,8 +393,6 @@ static void hp_wmi_notify(u32 value, void *context) } else printk(KERN_INFO "HP WMI: Unknown key pressed - %x\n", eventcode); - - kfree(obj); } static int __init hp_wmi_input_setup(void) -- cgit v1.2.3-70-g09d2