unimore/kernel-hacking-2024-linux-steffo
unimore/kernel-hacking-2024-linux-steffo
1
Fork 0
Code Pull requests 5 Wiki Activity

acer-wmi: fix obj is NULL but dereferenced

Browse source 
Fengguang Wu run coccinelle and warns about:
  drivers/platform/x86/acer-wmi.c:1200:17-21: ERROR: obj is NULL but dereferenced.
  drivers/platform/x86/acer-wmi.c:891:17-21: ERROR: obj is NULL but dereferenced.
  drivers/platform/x86/acer-wmi.c:1953:17-21: ERROR: obj is NULL but dereferenced.

It causes by the code in patch 987dfbaa65 doesn't check
obj variable should not be NULL. There have risk for dereference a NULL obj, so add
this patch to fix.

Cc: Carlos Corbacho <carlos@strangeworlds.co.uk>
Cc: Matthew Garrett <mjg@redhat.com>
Cc: Dmitry Torokhov <dtor@mail.ru>
Cc: Corentin Chary <corentincj@iksaif.net>
Cc: Thomas Renninger <trenn@suse.de>
Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
This commit is contained in:
Lee, Chun-Yi 2012-12-14 16:14:26 +08:00 committed by Matthew Garrett
parent 182ae55c12
commit f20aaba981
1 changed files with 25 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
drivers/platform/x86/acer-wmi.c
View file

@ -875,7 +875,7 @@ WMI_execute_u32(u32 method_id, u32 in, u32 *out)
struct acpi_buffer input = { (acpi_size) sizeof(u32), (void *)(&in) };
struct acpi_buffer result = { ACPI_ALLOCATE_BUFFER, NULL };
union acpi_object *obj;
u32 tmp;
u32 tmp = 0;
acpi_status status;
status = wmi_evaluate_method(WMID_GUID1, 1, method_id, &input, &result);
@ -884,14 +884,14 @@ WMI_execute_u32(u32 method_id, u32 in, u32 *out)
return status;
obj = (union acpi_object *) result.pointer;
if (obj && obj->type == ACPI_TYPE_BUFFER &&
(obj->buffer.length == sizeof(u32) ||
obj->buffer.length == sizeof(u64))) {
tmp = *((u32 *) obj->buffer.pointer);
} else if (obj->type == ACPI_TYPE_INTEGER) {
tmp = (u32) obj->integer.value;
} else {
tmp = 0;
if (obj) {
if (obj->type == ACPI_TYPE_BUFFER &&
(obj->buffer.length == sizeof(u32) ||
obj->buffer.length == sizeof(u64))) {
tmp = *((u32 *) obj->buffer.pointer);
} else if (obj->type == ACPI_TYPE_INTEGER) {
tmp = (u32) obj->integer.value;
}
}
if (out)
@ -1193,12 +1193,14 @@ static acpi_status WMID_set_capabilities(void)
return status;
obj = (union acpi_object *) out.pointer;
if (obj && obj->type == ACPI_TYPE_BUFFER &&
(obj->buffer.length == sizeof(u32) ||
obj->buffer.length == sizeof(u64))) {
devices = *((u32 *) obj->buffer.pointer);
} else if (obj->type == ACPI_TYPE_INTEGER) {
devices = (u32) obj->integer.value;
if (obj) {
if (obj->type == ACPI_TYPE_BUFFER &&
(obj->buffer.length == sizeof(u32) ||
obj->buffer.length == sizeof(u64))) {
devices = *((u32 *) obj->buffer.pointer);
} else if (obj->type == ACPI_TYPE_INTEGER) {
devices = (u32) obj->integer.value;
}
} else {
kfree(out.pointer);
return AE_ERROR;
@ -1946,12 +1948,14 @@ static u32 get_wmid_devices(void)
return 0;
obj = (union acpi_object *) out.pointer;
if (obj && obj->type == ACPI_TYPE_BUFFER &&
(obj->buffer.length == sizeof(u32) ||
obj->buffer.length == sizeof(u64))) {
devices = *((u32 *) obj->buffer.pointer);
} else if (obj->type == ACPI_TYPE_INTEGER) {
devices = (u32) obj->integer.value;
if (obj) {
if (obj->type == ACPI_TYPE_BUFFER &&
(obj->buffer.length == sizeof(u32) ||
obj->buffer.length == sizeof(u64))) {
devices = *((u32 *) obj->buffer.pointer);
} else if (obj->type == ACPI_TYPE_INTEGER) {
devices = (u32) obj->integer.value;
}
}
kfree(out.pointer);