TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wifi: iwlwifi: avoid memory leak

Browse Source 
[ Upstream commit 80e96206a3 ]

A caller of iwl_acpi_get_dsm_object must free the returned object.
iwl_acpi_get_dsm_integer returns immediately without freeing
it if the expected size is more than 8 bytes. Fix that.

Note that with the current code this will never happen, since the caller
of iwl_acpi_get_dsm_integer already checks that the expected size if
either 1 or 4 bytes, so it can't exceed 8 bytes.

While at it, print the DSM value instead of the return value, as this
was the intention in the first place.

Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20241228223206.bf61eaab99f8.Ibdc5df02f885208c222456d42c889c43b7e3b2f7@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Miri Korenblit
2024-12-28 22:34:15 +02:00
committed by Greg Kroah-Hartman
parent c9480e9f2d
commit d32136e5ba
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+8 -5
View File
@@ -155,7 +155,7 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
size_t expected_size)
{
union acpi_object *obj;
int ret = 0;
int ret;
obj = iwl_acpi_get_dsm_object(dev, rev, func, NULL, guid);
if (IS_ERR(obj)) {
@@ -170,8 +170,10 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
} else if (obj->type == ACPI_TYPE_BUFFER) {
__le64 le_value = 0;
if (WARN_ON_ONCE(expected_size > sizeof(le_value)))
return -EINVAL;
if (WARN_ON_ONCE(expected_size > sizeof(le_value))) {
ret = -EINVAL;
goto out;
}
/* if the buffer size doesn't match the expected size */
if (obj->buffer.length != expected_size)
@@ -192,8 +194,9 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
}
IWL_DEBUG_DEV_RADIO(dev,
"ACPI: DSM method evaluated: func=%d, ret=%d\n",
func, ret);
"ACPI: DSM method evaluated: func=%d, value=%lld\n",
func, *value);
ret = 0;
out:
ACPI_FREE(obj);
return ret;