diff options
author | Mark Langsdorf <mlangsdo@redhat.com> | 2021-04-23 10:28:17 -0500 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-05-11 14:04:01 +0200 |
commit | 72814a94c38a33239793f7622cec6ace1e540c4b (patch) | |
tree | 7aa2284fc9e83ad52a7698e65191e5b4bd46b4fc /drivers/acpi | |
parent | b691331218d0eadd72557e2ea7c6ca70adf0c3ae (diff) |
ACPI: custom_method: fix potential use-after-free issue
commit e483bb9a991bdae29a0caa4b3a6d002c968f94aa upstream.
In cm_write(), buf is always freed when reaching the end of the
function. If the requested count is less than table.length, the
allocated buffer will be freed but subsequent calls to cm_write() will
still try to access it.
Remove the unconditional kfree(buf) at the end of the function and
set the buf to NULL in the -EINVAL error path to match the rest of
function.
Fixes: 03d1571d9513 ("ACPI: custom_method: fix memory leaks")
Signed-off-by: Mark Langsdorf <mlangsdo@redhat.com>
Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/acpi')
-rw-r--r-- | drivers/acpi/custom_method.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c index b097ef209313..dfe097d07202 100644 --- a/drivers/acpi/custom_method.c +++ b/drivers/acpi/custom_method.c @@ -57,6 +57,7 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, (*ppos + count < count) || (count > uncopied_bytes)) { kfree(buf); + buf = NULL; return -EINVAL; } @@ -78,7 +79,6 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE); } - kfree(buf); return count; } |