github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ACPI: SBS: Fix NULL pointer dereference on allocation failure

Browse Source 
acpi_sbs_probe() jumps to the common error path when kzalloc_obj()
fails, but platform_set_drvdata() is only called after the allocation
succeeds.

The error path calls acpi_sbs_remove(), which retrieves the unset
driver data and dereferences the resulting NULL pointer when locking
sbs->lock, causing a NULL pointer dereference.

Return -ENOMEM directly when the allocation fails, since no resources
have been initialized at that point and there is nothing to clean up.

This issue was found by manual code inspection.

Fixes: 9460eaae2e ("ACPI: SBS: Convert the driver to a platform one")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260912113355.644238-1-lgs201920130244@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
Guangshuo Li 2026-09-12 19:33:55 +08:00 committed by Rafael J. Wysocki
parent 7c0940e431
commit 2b30842e52
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/acpi/sbs.c
View File

@ -639,10 +639,8 @@ static int acpi_sbs_probe(struct platform_device *pdev)
return -ENODEV;
sbs = kzalloc_obj(struct acpi_sbs);
if (!sbs) {
result = -ENOMEM;
goto end;
}
if (!sbs)
return -ENOMEM;
mutex_init(&sbs->lock);