Commit d1dd0c23 authored by Paulo Marques's avatar Paulo Marques Committed by Len Brown

[ACPI] fix kmalloc size bug in acpi/video.c

acpi_video_device_find_cap() used &p instead of *p
when calculating storage size, thus allocating
only 4 or 8 bytes instead of 12...

Also, kfree(NULL) is legal, so remove some unneeded checks.

From: Paulo Marques <pmarques@grupopie.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLen Brown <len.brown@intel.com>
parent 7334571f
...@@ -564,12 +564,13 @@ acpi_video_device_find_cap (struct acpi_video_device *device) ...@@ -564,12 +564,13 @@ acpi_video_device_find_cap (struct acpi_video_device *device)
int count = 0; int count = 0;
union acpi_object *o; union acpi_object *o;
br = kmalloc(sizeof &br, GFP_KERNEL); br = kmalloc(sizeof(*br), GFP_KERNEL);
if (!br) { if (!br) {
printk(KERN_ERR "can't allocate memory\n"); printk(KERN_ERR "can't allocate memory\n");
} else { } else {
memset(br, 0, sizeof &br); memset(br, 0, sizeof(*br));
br->levels = kmalloc(obj->package.count * sizeof &br->levels, GFP_KERNEL); br->levels = kmalloc(obj->package.count *
sizeof *(br->levels), GFP_KERNEL);
if (!br->levels) if (!br->levels)
goto out; goto out;
...@@ -584,8 +585,7 @@ acpi_video_device_find_cap (struct acpi_video_device *device) ...@@ -584,8 +585,7 @@ acpi_video_device_find_cap (struct acpi_video_device *device)
} }
out: out:
if (count < 2) { if (count < 2) {
if (br->levels) kfree(br->levels);
kfree(br->levels);
kfree(br); kfree(br);
} else { } else {
br->count = count; br->count = count;
...@@ -595,8 +595,7 @@ acpi_video_device_find_cap (struct acpi_video_device *device) ...@@ -595,8 +595,7 @@ acpi_video_device_find_cap (struct acpi_video_device *device)
} }
} }
if (obj) kfree(obj);
kfree(obj);
return_VOID; return_VOID;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment