2011-03-26 18:18:41

by Mariusz Kozlowski

[permalink] [raw]
Subject: [PATCH] ACPI battery: fix possible use after free in acpi_battery_add()

When acpi_battery_add_fs() fails 'battery' will be kfreed and then
used again.

Signed-off-by: Mariusz Kozlowski <[email protected]>
---
drivers/acpi/battery.c | 15 ++++++---------
1 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index fcc13ac..27375e7 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -978,18 +978,15 @@ static int acpi_battery_add(struct acpi_device *device)
acpi_battery_update(battery);
#ifdef CONFIG_ACPI_PROCFS_POWER
result = acpi_battery_add_fs(device);
-#endif
- if (!result) {
- printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",
- ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),
- device->status.battery_present ? "present" : "absent");
- } else {
-#ifdef CONFIG_ACPI_PROCFS_POWER
+ if (result) {
acpi_battery_remove_fs(device);
-#endif
kfree(battery);
+ return result;
}
-
+#endif
+ printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",
+ ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),
+ device->status.battery_present ? "present" : "absent");
battery->pm_nb.notifier_call = battery_notify;
register_pm_notifier(&battery->pm_nb);

--
1.7.0.4