diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2021-05-26 14:34:39 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2021-06-02 13:32:37 +0000 |
| commit | 78b147467ea55886071b099d364757e827afbcd7 (patch) | |
| tree | 0a9c048e956e40fdcc2c253d5681da8f846aa0be | |
| parent | c64d1bd7145b5d30c97d1cd99e584da529d95100 (diff) | |
acpi: Add missing error handling to acpi_pci_link_route_irqs()
Otherwise the resouce buffer may have been freed when
AcpiSetCurrentResources() is called, leading to a use-after-free.
PR: 255862
Submitted by: Lv Yunlong <lylgood@foxmail.com> (original version)
MFC after: 1 week
(cherry picked from commit 4cf33275289088e3b0a913a44b5cd549e348094d)
| -rw-r--r-- | sys/dev/acpica/acpi_pci_link.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sys/dev/acpica/acpi_pci_link.c b/sys/dev/acpica/acpi_pci_link.c index ecc4f26d3fb4..3dab2807bd92 100644 --- a/sys/dev/acpica/acpi_pci_link.c +++ b/sys/dev/acpica/acpi_pci_link.c @@ -843,8 +843,10 @@ acpi_pci_link_srs_from_links(struct acpi_pci_link_softc *sc, device_printf(sc->pl_dev, "Unable to build resources: %s\n", AcpiFormatException(status)); - if (srsbuf->Pointer != NULL) + if (srsbuf->Pointer != NULL) { AcpiOsFree(srsbuf->Pointer); + srsbuf->Pointer = NULL; + } return (status); } } @@ -867,6 +869,8 @@ acpi_pci_link_route_irqs(device_t dev) status = acpi_pci_link_srs_from_links(sc, &srsbuf); else status = acpi_pci_link_srs_from_crs(sc, &srsbuf); + if (ACPI_FAILURE(status)) + return (status); /* Write out new resources via _SRS. */ status = AcpiSetCurrentResources(acpi_get_handle(dev), &srsbuf); |