title: ACPI: custom_method: fix potential use-after-free issue
description: In the Linux kernel, the following vulnerability has been resolved:
ACPI: custom_method: fix potential use-after-free issue
In cm_write(), buf is always freed when reaching the end of the
function.  If the requested count is less than table.length, the
allocated buffer will be freed but subsequent calls to cm_write() will
still try to access it.
Remove the unconditional kfree(buf) at the end of the function and
set the buf to NULL in the -EINVAL error path to match the rest of
function.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 4bda2b79a9d0, lessThan: 1d53ca5d1310, status: affected, versionType: git
version: 5c12dadcbef8, lessThan: 8b04d57f30ca, status: affected, versionType: git
version: 35b88a10535e, lessThan: 90575d1d9311, status: affected, versionType: git
version: e4467fb6ef54, lessThan: a5b26a2e362f, status: affected, versionType: git
version: 03d1571d9513, lessThan: 72814a94c38a, status: affected, versionType: git
version: 03d1571d9513, lessThan: 62dc2440ebb5, status: affected, versionType: git
version: 03d1571d9513, lessThan: f16737caf41f, status: affected, versionType: git
version: 03d1571d9513, lessThan: b7a5baaae212, status: affected, versionType: git
version: 03d1571d9513, lessThan: e483bb9a991b, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 5.4, status: affected
version: 0, lessThan: 5.4, status: unaffected, versionType: custom
version: 4.4.269, lessThanOrEqual: 4.4.*, status: unaffected, versionType: custom
version: 4.9.269, lessThanOrEqual: 4.9.*, status: unaffected, versionType: custom
version: 4.14.233, lessThanOrEqual: 4.14.*, status: unaffected, versionType: custom
version: 4.19.191, lessThanOrEqual: 4.19.*, status: unaffected, versionType: custom
version: 5.4.118, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.36, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.11.20, lessThanOrEqual: 5.11.*, status: unaffected, versionType: custom
version: 5.12.3, lessThanOrEqual: 5.12.*, status: unaffected, versionType: custom
version: 5.13, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
