Commit e80bba4b authored by Stefan Hajnoczi's avatar Stefan Hajnoczi Committed by Len Brown
Browse files

ACPI / Battery: avoid acpi_battery_add() use-after-free 



When acpi_battery_add_fs() fails the error handling code does not clean
up completely.  Moreover, it does not return resulting in a
use-after-free.

Signed-off-by: default avatarStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: default avatarLen Brown <len.brown@intel.com>
parent 9c921c22

drivers/acpi/battery.c

+12 −6
Original line number Diff line number Diff line
@@ -986,21 +986,27 @@ static int acpi_battery_add(struct acpi_device *device) 
#ifdef CONFIG_ACPI_PROCFS_POWER

	result = acpi_battery_add_fs(device);

#endif

	if (!result) {

		printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",

			ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),

			device->status.battery_present ? "present" : "absent");

	} else {

	if (result) {

#ifdef CONFIG_ACPI_PROCFS_POWER

		acpi_battery_remove_fs(device);

#endif

		kfree(battery);

		goto fail;

	}



	printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",

		ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),

		device->status.battery_present ? "present" : "absent");



	battery->pm_nb.notifier_call = battery_notify;

	register_pm_notifier(&battery->pm_nb);



	return result;



fail:

	sysfs_remove_battery(battery);

	mutex_destroy(&battery->lock);

	kfree(battery);

	return result;

}



static int acpi_battery_remove(struct acpi_device *device, int type)