diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2021-05-26 14:34:39 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2021-06-02 13:36:03 +0000 |
| commit | a53f3a29bf6d3af7cbddaf97b04b05cac7e923a6 (patch) | |
| tree | d56833c72dab7014aa491c0085acbf25d26def3a | |
| parent | 19888502bf39ca46450546954f1563e62f6c4159 (diff) | |
acpi: Add missing error handling to acpi_pci_link_route_irqs()
Otherwise the resouce buffer may have been freed when
AcpiSetCurrentResources() is called, leading to a use-after-free.
PR: 255862
Submitted by: Lv Yunlong <lylgood@foxmail.com> (original version)
MFC after: 1 week
(cherry picked from commit 4cf33275289088e3b0a913a44b5cd549e348094d)
| -rw-r--r-- | sys/dev/acpica/acpi_pci_link.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sys/dev/acpica/acpi_pci_link.c b/sys/dev/acpica/acpi_pci_link.c index 660407604256..f5378e6ca3cf 100644 --- a/sys/dev/acpica/acpi_pci_link.c +++ b/sys/dev/acpica/acpi_pci_link.c @@ -843,8 +843,10 @@ acpi_pci_link_srs_from_links(struct acpi_pci_link_softc *sc, device_printf(sc->pl_dev, "Unable to build resources: %s\n", AcpiFormatException(status)); - if (srsbuf->Pointer != NULL) + if (srsbuf->Pointer != NULL) { AcpiOsFree(srsbuf->Pointer); + srsbuf->Pointer = NULL; + } return (status); } } @@ -867,6 +869,8 @@ acpi_pci_link_route_irqs(device_t dev) status = acpi_pci_link_srs_from_links(sc, &srsbuf); else status = acpi_pci_link_srs_from_crs(sc, &srsbuf); + if (ACPI_FAILURE(status)) + return (status); /* Write out new resources via _SRS. */ status = AcpiSetCurrentResources(acpi_get_handle(dev), &srsbuf); |