diff mbox series

[SRU,M,v5,2/2] ACPI: utils: Fix error path in acpi_evaluate_reference()

Message ID 20240301075122.7242-3-ivan.hu@canonical.com
State New
Headers show
Series Dynamically determine acpi_handle_list size | expand

Commit Message

Ivan Hu March 1, 2024, 7:51 a.m. UTC 
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>

BugLink: https://bugs.launchpad.net/bugs/2049733

If a pointer to an uninitialized struct acpi_handle_list is passed to
acpi_evaluate_reference() and it decides to bail out early, either
because acpi_evaluate_object() fails, or because it produces invalid
data, the handles pointer from the struct acpi_handle_list will be
passed to kfree() and if it is not NULL, the kernel will crash on an
attempt to free unallocated memory.

Address this by moving the "end" label in acpi_evaluate_reference() to
the end of the function, which is sufficient, because no cleanup is
needed in that case.

Fixes: 2e57d10a6591 ("ACPI: utils: Dynamically determine acpi_handle_list size")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Tested-by: Woody Suwalski <terraluna977@gmail.com>
(backported from commit 8f0b960a42badda7a2781e8a33564624200debc9)
[Ivan Hu: change spaces]
Signed-off-by: Ivan Hu <ivan.hu@canonical.com>
---
 drivers/acpi/utils.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c
index c6f83c21bb2a..7c8af9c14981 100644
--- a/drivers/acpi/utils.c
+++ b/drivers/acpi/utils.c
@@ -400,13 +400,13 @@  acpi_evaluate_reference(acpi_handle handle,
 		acpi_handle_debug(list->handles[i], "Found in reference list\n");
 	}
 
-      end:
 	if (ACPI_FAILURE(status)) {
 		list->count = 0;
 		kfree(list->handles);
 		list->handles = NULL;
 	}
 
+end:
 	kfree(buffer.pointer);
 
 	return status;