diff mbox

ACPI: use after free in acpi_battery_add()

Message ID 20110329031210.GA9856@bicker (mailing list archive)
State New, archived
Headers show

Commit Message

Dan Carpenter March 29, 2011, 3:12 a.m. UTC 
None

Comments

Dan Carpenter June 16, 2011, 7:18 p.m. UTC | #1 
It seems like this patch was missed.

regards,
dan carpenter

On 3/29/11, Dan Carpenter <error27@gmail.com> wrote:
> "battery" was dereferenced on the error path here.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
>
> diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
> index fcc13ac..cfc7a5b 100644
> --- a/drivers/acpi/battery.c
> +++ b/drivers/acpi/battery.c
> @@ -988,6 +988,7 @@ static int acpi_battery_add(struct acpi_device *device)
>  		acpi_battery_remove_fs(device);
>  #endif
>  		kfree(battery);
> +		return result;
>  	}
>
>  	battery->pm_nb.notifier_call = battery_notify;
>
--
To unsubscribe from this list: send the line "unsubscribe linux-acpi" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index fcc13ac..cfc7a5b 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -988,6 +988,7 @@  static int acpi_battery_add(struct acpi_device *device)
 		acpi_battery_remove_fs(device);
 #endif
 		kfree(battery);
+		return result;
 	}
 
 	battery->pm_nb.notifier_call = battery_notify;