On 07/15/16 15:55, Haozhong Zhang wrote:
On 07/14/16 20:28, Dan Williams wrote:
> acpi_evaluate_object() allocates memory. Free the buffer allocated
> during acpi_nfit_add().
>
> Cc: <stable(a)vger.kernel.org>
> Cc: Vishal Verma <vishal.l.verma(a)intel.com>
> Reported-by: Xiao Guangrong <guangrong.xiao(a)intel.com>
> Reported-by: Haozhong Zhang <haozhong.zhang(a)intel.com>
> Signed-off-by: Dan Williams <dan.j.williams(a)intel.com>
> ---
> drivers/acpi/nfit.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c
> index 0497175ee6cb..008dbaaa2b75 100644
> --- a/drivers/acpi/nfit.c
> +++ b/drivers/acpi/nfit.c
> @@ -2414,12 +2414,15 @@ static int acpi_nfit_add(struct acpi_device *adev)
> acpi_desc->nfit =
> (struct acpi_nfit_header *)obj->buffer.pointer;
> sz = obj->buffer.length;
> + rc = acpi_nfit_init(acpi_desc, sz);
> } else
> dev_dbg(dev, "%s invalid type %d, ignoring _FIT\n",
> __func__, (int) obj->type);
'rc' is not set in this path, so it maybe used uninitialized by 'if (rc)'
below.
Should we set it to a non-zero value in this path?
'rc' should be set to 0 here, as what patch 2 does. Sorry for my mistake.
Haozhong