Skip to content

Commit

Permalink
ACPI: fix NULL bug for HID/UID string
Browse files Browse the repository at this point in the history
acpi_device->pnp.hardware_id and unique_id are now allocated pointers,
replacing the previous arrays.  acpi_device_install_notify_handler()
oopsed on the NULL hid when probing the video device, and perhaps other
uses are vulnerable too.  So initialize those pointers to empty strings
when there is no hid or uid.  Also, free hardware_id and unique_id when
when acpi_device is going to be freed.

http://bugzilla.kernel.org/show_bug.cgi?id=14096

Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
  • Loading branch information
Hugh Dickins authored and Len Brown committed Sep 1, 2009
1 parent 49ae80c commit 718fb0d
Showing 1 changed file with 12 additions and 8 deletions.
20 changes: 12 additions & 8 deletions drivers/acpi/scan.c
Original file line number Diff line number Diff line change
Expand Up @@ -309,6 +309,10 @@ static void acpi_device_release(struct device *dev)
struct acpi_device *acpi_dev = to_acpi_device(dev);

kfree(acpi_dev->pnp.cid_list);
if (acpi_dev->flags.hardware_id)
kfree(acpi_dev->pnp.hardware_id);
if (acpi_dev->flags.unique_id)
kfree(acpi_dev->pnp.unique_id);
kfree(acpi_dev);
}

Expand Down Expand Up @@ -1137,17 +1141,19 @@ static void acpi_device_set_id(struct acpi_device *device,
strcpy(device->pnp.hardware_id, hid);
device->flags.hardware_id = 1;
}
} else
device->pnp.hardware_id = NULL;
}
if (!device->flags.hardware_id)
device->pnp.hardware_id = "";

if (uid) {
device->pnp.unique_id = ACPI_ALLOCATE_ZEROED(strlen (uid) + 1);
if (device->pnp.unique_id) {
strcpy(device->pnp.unique_id, uid);
device->flags.unique_id = 1;
}
} else
device->pnp.unique_id = NULL;
}
if (!device->flags.unique_id)
device->pnp.unique_id = "";

if (cid_list || cid_add) {
struct acpica_device_id_list *list;
Expand Down Expand Up @@ -1362,10 +1368,8 @@ acpi_add_single_object(struct acpi_device **child,
end:
if (!result)
*child = device;
else {
kfree(device->pnp.cid_list);
kfree(device);
}
else
acpi_device_release(&device->dev);

return result;
}
Expand Down

0 comments on commit 718fb0d

Please sign in to comment.