Skip to contentSkip to conversation

ACPI: use after free in acpi_battery_add()

PATCH In review Dan Carpenter 1 participant 2 messages Mar 29, 2011 – Jun 16, 2011

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 ACPI: use after free in acpi_battery_add()

"battery" was dereferenced on the error path here.

drivers/acpi/battery.c +1 -0
index fcc13ac..cfc7a5b 100644
@@ -988,6 +988,7 @@ static int acpi_battery_add(struct acpi_device *device)
 		acpi_battery_remove_fs(device);
 #endif
 		kfree(battery);
+		return result;
 	}
 
 	battery->pm_nb.notifier_call = battery_notify;
#1 lore raw

It seems like this patch was missed.

regards,
dan carpenter

Quoted 17 lines · Dan Carpenter

"battery" was dereferenced on the error path here.

drivers/acpi/battery.c +1 -0
index fcc13ac..cfc7a5b 100644
@@ -988,6 +988,7 @@ static int acpi_battery_add(struct acpi_device *device)
 		acpi_battery_remove_fs(device);
 #endif
 		kfree(battery);
+		return result;
 	}
 
 	battery->pm_nb.notifier_call = battery_notify;