| From e483bb9a991bdae29a0caa4b3a6d002c968f94aa Mon Sep 17 00:00:00 2001 |
| From: Mark Langsdorf <mlangsdo@redhat.com> |
| Date: Fri, 23 Apr 2021 10:28:17 -0500 |
| Subject: ACPI: custom_method: fix potential use-after-free issue |
| |
| From: Mark Langsdorf <mlangsdo@redhat.com> |
| |
| commit e483bb9a991bdae29a0caa4b3a6d002c968f94aa upstream. |
| |
| In cm_write(), buf is always freed when reaching the end of the |
| function. If the requested count is less than table.length, the |
| allocated buffer will be freed but subsequent calls to cm_write() will |
| still try to access it. |
| |
| Remove the unconditional kfree(buf) at the end of the function and |
| set the buf to NULL in the -EINVAL error path to match the rest of |
| function. |
| |
| Fixes: 03d1571d9513 ("ACPI: custom_method: fix memory leaks") |
| Signed-off-by: Mark Langsdorf <mlangsdo@redhat.com> |
| Cc: 5.4+ <stable@vger.kernel.org> # 5.4+ |
| Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/acpi/custom_method.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/acpi/custom_method.c |
| +++ b/drivers/acpi/custom_method.c |
| @@ -50,6 +50,7 @@ static ssize_t cm_write(struct file *fil |
| (*ppos + count < count) || |
| (count > uncopied_bytes)) { |
| kfree(buf); |
| + buf = NULL; |
| return -EINVAL; |
| } |
| |
| @@ -71,7 +72,6 @@ static ssize_t cm_write(struct file *fil |
| add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE); |
| } |
| |
| - kfree(buf); |
| return count; |
| } |
| |