evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ACPI / PM: Fix possible NULL pointer deref in acpi_pm_device_sleep_state()

Browse source 
After commit fa1675b (ACPI / PM: Rework and clean up
acpi_dev_pm_get_state()) a NULL pointer dereference will take place
if NULL is passed to acpi_pm_device_sleep_state() as the second
argument.

Fix that by avoiding to use the pointer that may be NULL until
it's necessary to store a return value at the location pointed to
by it (if not NULL).

Reported-and-tested-by: Aaron Lu <aaron.lu@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
Rafael J. Wysocki 2013-06-27 14:01:02 +02:00
parent fa1675b565
commit 9b5c7a5a97
1 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
drivers/acpi/device_pm.c
View file

@ -521,7 +521,7 @@ int acpi_pm_device_sleep_state(struct device *dev, int *d_min_p, int d_max_in)
{ {
acpi_handle handle = DEVICE_ACPI_HANDLE(dev); acpi_handle handle = DEVICE_ACPI_HANDLE(dev);
struct acpi_device *adev; struct acpi_device *adev;
int ret, d_max; int ret, d_min, d_max;
if (d_max_in < ACPI_STATE_D0 || d_max_in > ACPI_STATE_D3_COLD) if (d_max_in < ACPI_STATE_D0 || d_max_in > ACPI_STATE_D3_COLD)
return -EINVAL; return -EINVAL;
@ -540,19 +540,23 @@ int acpi_pm_device_sleep_state(struct device *dev, int *d_min_p, int d_max_in)
} }
ret = acpi_dev_pm_get_state(dev, adev, acpi_target_system_state(), ret = acpi_dev_pm_get_state(dev, adev, acpi_target_system_state(),
d_min_p, &d_max); &d_min, &d_max);
if (ret) if (ret)
return ret; return ret;
if (d_max_in < *d_min_p) if (d_max_in < d_min)
return -EINVAL; return -EINVAL;
if (d_max > d_max_in) { if (d_max > d_max_in) {
for (d_max = d_max_in; d_max > *d_min_p; d_max--) { for (d_max = d_max_in; d_max > d_min; d_max--) {
if (adev->power.states[d_max].flags.valid) if (adev->power.states[d_max].flags.valid)
break; break;
} }
} }
if (d_min_p)
*d_min_p = d_min;
return d_max; return d_max;
} }
EXPORT_SYMBOL(acpi_pm_device_sleep_state); EXPORT_SYMBOL(acpi_pm_device_sleep_state);