Commit accad1ba authored by Rui Miguel Silva's avatar Rui Miguel Silva Committed by Greg Kroah-Hartman

greybus: power_supply: fix use after free of power supply

Individual power supply were being freed and checked using the wrong
pointers and at the wrong place, which would make several issues, like
used after free and so on.
Fix it by freeing all allocated memory after release individual power
supply.
Signed-off-by: default avatarRui Miguel Silva <rui.silva@linaro.org>
Reported-by: default avatarJohan Hovold <johan@hovoldconsulting.com>
Reviewed-by: default avatarJohan Hovold <johan@hovoldconsulting.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parent f921fb13
...@@ -544,13 +544,10 @@ static void _gb_power_supply_free(struct gb_power_supply *gbpsy) ...@@ -544,13 +544,10 @@ static void _gb_power_supply_free(struct gb_power_supply *gbpsy)
kfree(gbpsy->manufacturer); kfree(gbpsy->manufacturer);
kfree(gbpsy->props_raw); kfree(gbpsy->props_raw);
kfree(gbpsy->props); kfree(gbpsy->props);
kfree(gbpsy);
} }
static void _gb_power_supply_release(struct gb_power_supply *gbpsy) static void _gb_power_supply_release(struct gb_power_supply *gbpsy)
{ {
if (!gbpsy)
return;
gbpsy->update_interval = 0; gbpsy->update_interval = 0;
...@@ -576,6 +573,7 @@ static void _gb_power_supplies_release(struct gb_power_supplies *supplies) ...@@ -576,6 +573,7 @@ static void _gb_power_supplies_release(struct gb_power_supplies *supplies)
mutex_lock(&supplies->supplies_lock); mutex_lock(&supplies->supplies_lock);
for (i = 0; i < supplies->supplies_count; i++) for (i = 0; i < supplies->supplies_count; i++)
_gb_power_supply_release(&supplies->supply[i]); _gb_power_supply_release(&supplies->supply[i]);
kfree(supplies->supply);
mutex_unlock(&supplies->supplies_lock); mutex_unlock(&supplies->supplies_lock);
kfree(supplies); kfree(supplies);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment