mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-23 04:34:11 +08:00
ACPI: PRM: Handle memory allocation and memory remap failure
Handle memory allocation and memory remap failure in acpi_parse_prmt() when system runs out of memory to avoid the potential NULL pointer dereference errors. Signed-off-by: Aubrey Li <aubrey.li@linux.intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
parent
caa2bd07f5
commit
c52ca71327
@ -96,7 +96,7 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
|
||||
struct acpi_prmt_handler_info *handler_info;
|
||||
struct prm_handler_info *th;
|
||||
struct prm_module_info *tm;
|
||||
u64 mmio_count = 0;
|
||||
u64 *mmio_count;
|
||||
u64 cur_handler = 0;
|
||||
u32 module_info_size = 0;
|
||||
u64 mmio_range_size = 0;
|
||||
@ -105,6 +105,8 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
|
||||
module_info = (struct acpi_prmt_module_info *) header;
|
||||
module_info_size = struct_size(tm, handlers, module_info->handler_info_count);
|
||||
tm = kmalloc(module_info_size, GFP_KERNEL);
|
||||
if (!tm)
|
||||
goto parse_prmt_out1;
|
||||
|
||||
guid_copy(&tm->guid, (guid_t *) module_info->module_guid);
|
||||
tm->major_rev = module_info->major_rev;
|
||||
@ -117,14 +119,24 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
|
||||
* Each module is associated with a list of addr
|
||||
* ranges that it can use during the service
|
||||
*/
|
||||
mmio_count = *(u64 *) memremap(module_info->mmio_list_pointer, 8, MEMREMAP_WB);
|
||||
mmio_range_size = struct_size(tm->mmio_info, addr_ranges, mmio_count);
|
||||
mmio_count = (u64 *) memremap(module_info->mmio_list_pointer, 8, MEMREMAP_WB);
|
||||
if (!mmio_count)
|
||||
goto parse_prmt_out2;
|
||||
|
||||
mmio_range_size = struct_size(tm->mmio_info, addr_ranges, *mmio_count);
|
||||
tm->mmio_info = kmalloc(mmio_range_size, GFP_KERNEL);
|
||||
if (!tm->mmio_info)
|
||||
goto parse_prmt_out3;
|
||||
|
||||
temp_mmio = memremap(module_info->mmio_list_pointer, mmio_range_size, MEMREMAP_WB);
|
||||
if (!temp_mmio)
|
||||
goto parse_prmt_out4;
|
||||
memmove(tm->mmio_info, temp_mmio, mmio_range_size);
|
||||
} else {
|
||||
mmio_range_size = struct_size(tm->mmio_info, addr_ranges, mmio_count);
|
||||
tm->mmio_info = kmalloc(mmio_range_size, GFP_KERNEL);
|
||||
tm->mmio_info = kmalloc(sizeof(*tm->mmio_info), GFP_KERNEL);
|
||||
if (!tm->mmio_info)
|
||||
goto parse_prmt_out2;
|
||||
|
||||
tm->mmio_info->mmio_count = 0;
|
||||
}
|
||||
|
||||
@ -142,6 +154,15 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
|
||||
} while (++cur_handler < tm->handler_count && (handler_info = get_next_handler(handler_info)));
|
||||
|
||||
return 0;
|
||||
|
||||
parse_prmt_out4:
|
||||
kfree(tm->mmio_info);
|
||||
parse_prmt_out3:
|
||||
memunmap(mmio_count);
|
||||
parse_prmt_out2:
|
||||
kfree(tm);
|
||||
parse_prmt_out1:
|
||||
return -ENOMEM;
|
||||
}
|
||||
|
||||
#define GET_MODULE 0
|
||||
|
Loading…
Reference in New Issue
Block a user