shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 18:41:58 +09:00
Code Issues Packages Projects Releases Wiki Activity

wifi: iwlwifi: avoid memory leak

Browse Source 
[ Upstream commit 80e96206a3ef348fbd658d98f2f43149c36df8bc ]

A caller of iwl_acpi_get_dsm_object must free the returned object.
iwl_acpi_get_dsm_integer returns immediately without freeing
it if the expected size is more than 8 bytes. Fix that.

Note that with the current code this will never happen, since the caller
of iwl_acpi_get_dsm_integer already checks that the expected size if
either 1 or 4 bytes, so it can't exceed 8 bytes.

While at it, print the DSM value instead of the return value, as this
was the intention in the first place.

Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20241228223206.bf61eaab99f8.Ibdc5df02f885208c222456d42c889c43b7e3b2f7@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Miri Korenblit
2024-12-28 22:34:15 +02:00
committed by Greg Kroah-Hartman
parent af525a8b2a
commit 7ce13d8b59
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/net/wireless/intel/iwlwifi/fw/acpi.c
View File

@@ -123,7 +123,7 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
size_t expected_size) size_t expected_size)
{ {
union acpi_object *obj; union acpi_object *obj;
int ret = 0; int ret;
obj = iwl_acpi_get_dsm_object(dev, rev, func, NULL, guid); obj = iwl_acpi_get_dsm_object(dev, rev, func, NULL, guid);
if (IS_ERR(obj)) { if (IS_ERR(obj)) {
@@ -138,8 +138,10 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
} else if (obj->type == ACPI_TYPE_BUFFER) { } else if (obj->type == ACPI_TYPE_BUFFER) {
__le64 le_value = 0; __le64 le_value = 0;
if (WARN_ON_ONCE(expected_size > sizeof(le_value))) if (WARN_ON_ONCE(expected_size > sizeof(le_value))) {
return -EINVAL; ret = -EINVAL;
goto out;
}
/* if the buffer size doesn't match the expected size */ /* if the buffer size doesn't match the expected size */
if (obj->buffer.length != expected_size) if (obj->buffer.length != expected_size)
@@ -160,8 +162,9 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
} }
IWL_DEBUG_DEV_RADIO(dev, IWL_DEBUG_DEV_RADIO(dev,
"ACPI: DSM method evaluated: func=%d, ret=%d\n", "ACPI: DSM method evaluated: func=%d, value=%lld\n",
func, ret); func, *value);
ret = 0;
out: out:
ACPI_FREE(obj); ACPI_FREE(obj);
return ret; return ret;