6:41 a.m.
tree: https://android.googlesource.com/kernel/common android-3.18
head: 45b25566bb83cdb7046b400ac6f7f7f0def86e2f
commit: 857260113eeb7c145dd939728eca0477394248f5 [721/753] platform/x86: alienware-wmi:
Correct a memory leak
config: x86_64-randconfig-m001-20210323 (attached as .config)
compiler: gcc-5 (Ubuntu 5.5.0-12ubuntu1) 5.5.0 20171010
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com>
smatch warnings:
drivers/platform/x86/alienware-wmi.c:468 alienware_hdmi_command() error: double free of
'output.pointer'
vim +468 drivers/platform/x86/alienware-wmi.c
bc2ef884320bdc Mario Limonciello 2014-05-07 443 static acpi_status
alienware_hdmi_command(struct hdmi_args *in_args,
bc2ef884320bdc Mario Limonciello 2014-05-07 444 u32 command, int *out_data)
a46ad0f13bc32a Mario Limonciello 2014-04-04 445 {
a46ad0f13bc32a Mario Limonciello 2014-04-04 446 acpi_status status;
a46ad0f13bc32a Mario Limonciello 2014-04-04 447 union acpi_object *obj;
bc2ef884320bdc Mario Limonciello 2014-05-07 448 struct acpi_buffer input;
bc2ef884320bdc Mario Limonciello 2014-05-07 449 struct acpi_buffer output;
bc2ef884320bdc Mario Limonciello 2014-05-07 450
bc2ef884320bdc Mario Limonciello 2014-05-07 451 input.length = (acpi_size)
sizeof(*in_args);
bc2ef884320bdc Mario Limonciello 2014-05-07 452 input.pointer = in_args;
b6f226670369d6 Colin Ian King 2019-03-30 453 if (out_data) {
bc2ef884320bdc Mario Limonciello 2014-05-07 454 output.length = ACPI_ALLOCATE_BUFFER;
bc2ef884320bdc Mario Limonciello 2014-05-07 455 output.pointer = NULL;
bc2ef884320bdc Mario Limonciello 2014-05-07 456 status =
wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
bc2ef884320bdc Mario Limonciello 2014-05-07 457 command, &input,
&output);
b6f226670369d6 Colin Ian King 2019-03-30 458 if (ACPI_SUCCESS(status)) {
bc2ef884320bdc Mario Limonciello 2014-05-07 459 obj = (union acpi_object
*)output.pointer;
bc2ef884320bdc Mario Limonciello 2014-05-07 460 if (obj && obj->type ==
ACPI_TYPE_INTEGER)
bc2ef884320bdc Mario Limonciello 2014-05-07 461 *out_data =
(u32)obj->integer.value;
bc2ef884320bdc Mario Limonciello 2014-05-07 462 }
b6f226670369d6 Colin Ian King 2019-03-30 463 kfree(output.pointer);
^^^^^^^^^^^^^^^^^^^^^
This kfree is correct.
b6f226670369d6 Colin Ian King 2019-03-30 464 } else {
b6f226670369d6 Colin Ian King 2019-03-30 465 status =
wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
b6f226670369d6 Colin Ian King 2019-03-30 466 command, &input, NULL);
b6f226670369d6 Colin Ian King 2019-03-30 467 }
857260113eeb7c Mario Limonciello 2018-09-10 @468 kfree(output.pointer);
^^^^^^^^^^^^^^^^^^^^^
This kfree is wrong. Uninitialized data and also a double free as the
checker warning says.
bc2ef884320bdc Mario Limonciello 2014-05-07 469 return status;
bc2ef884320bdc Mario Limonciello 2014-05-07 470 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
_______________________________________________
kbuild mailing list -- kbuild(a)lists.01.org
To unsubscribe send an email to kbuild-leave(a)lists.01.org