aboutsummaryrefslogtreecommitdiff
path: root/include/linux/usb.h
diff options
context:
space:
mode:
authorMark Langsdorf <[email protected]>2021-04-23 10:28:17 -0500
committerRafael J. Wysocki <[email protected]>2021-04-28 19:15:30 +0200
commite483bb9a991bdae29a0caa4b3a6d002c968f94aa (patch)
tree53ecd99c930bedcfd25fbfc5ef1718c928278a3f /include/linux/usb.h
parentd8f9176b4ece17e831306072678cd9ae49688cf5 (diff)
ACPI: custom_method: fix potential use-after-free issue
In cm_write(), buf is always freed when reaching the end of the function. If the requested count is less than table.length, the allocated buffer will be freed but subsequent calls to cm_write() will still try to access it. Remove the unconditional kfree(buf) at the end of the function and set the buf to NULL in the -EINVAL error path to match the rest of function. Fixes: 03d1571d9513 ("ACPI: custom_method: fix memory leaks") Signed-off-by: Mark Langsdorf <[email protected]> Cc: 5.4+ <[email protected]> # 5.4+ Signed-off-by: Rafael J. Wysocki <[email protected]>
Diffstat (limited to 'include/linux/usb.h')
0 files changed, 0 insertions, 0 deletions