ACPI: use after free in acpi_battery_add()
Subsystems (2)
PATCH 1/1 ACPI: use after free in acpi_battery_add()
"battery" was dereferenced on the error path here.
Signed-off-by Dan Carpenter <[email protected]>
drivers/acpi/battery.c +1 -0
@@ -988,6 +988,7 @@ static int acpi_battery_add(struct acpi_device *device)acpi_battery_remove_fs (device);#endif kfree (battery); +return result; } battery->pm_nb.notifier_call = battery_notify;
It seems like this patch was missed.
regards,
dan carpenter
Quoted 17 lines · Dan Carpenter
"battery" was dereferenced on the error path here.
Signed-off-by Dan Carpenter <[email protected]>drivers/acpi/battery.c +1
-0@@ -988,6 +988,7 @@ static int acpi_battery_add(struct acpi_device *device)acpi_battery_remove_fs (device);#endif kfree (battery); +return result; } battery->pm_nb.notifier_call = battery_notify;