acpi: fix a leak of acpi_buffer objects in acpi_video_get_edid()

Commit Message

Ben Skeggs April 8, 2011, 5:12 a.m. UTC

From: Ulrich Obergfell <[e-mail]>

Commit 24b102d3488c9d201915d070a519e07098e0cd30 modified nouveau to take
a copy of the data returned by acpi_video_get_edid() to prevent an invalid
free later on.  This left a leak of the acpi_buffer.

A correct fix involves modifying the ACPI code to return a copy of the EDID
data, and freeing the acpi_buffer.

Signed-off-by: Ulrich Obergfell <[e-mail]>
Signed-off-by: Ben Skeggs <[e-mail]>
---
 drivers/acpi/video.c                   |    8 ++++++--
 drivers/gpu/drm/nouveau/nouveau_acpi.c |    2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

Patch

diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 31e9e10..e63ab12 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1332,8 +1332,12 @@  int acpi_video_get_edid(struct acpi_device *device, int type, int device_id,
 			}
 		}
 
-		*edid = buffer->buffer.pointer;
-		return length;
+		*edid = kmemdup(buffer->buffer.pointer, buffer->buffer.length, GFP_KERNEL);
+		kfree(buffer);
+		if (*edid)
+			return length;
+		else
+			return -ENOMEM;
 	}
 
 	return -ENODEV;
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index a542380..2d51a38 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -297,6 +297,6 @@  nouveau_acpi_edid(struct drm_device *dev, struct drm_connector *connector)
 	if (ret < 0)
 		return ret;
 
-	nv_connector->edid = kmemdup(edid, EDID_LENGTH, GFP_KERNEL);
+	nv_connector->edid = edid;
 	return 0;
 }