Messages in this thread Patch in this message | | | From | Chen Zhongjin <> | Subject | [PATCH] ACPICA: Fix pop_walk_state called after walk_state is deleted | Date | Mon, 7 Nov 2022 17:21:22 +0800 |
| |
In the previous fix patch acpi_ds_pop_walk_state() is called after acpi_ds_delete_walk_state() in cleanup, so the problem is not fixed because it is acpi_ds_pop_walk_state(NULL) called actually.
Also, when acpi_ds_create_walk_state() failed and next_walk_state is NULL, it pops the normal walk_state_list and make the memory leaked.
Check if next_walk_state is NULL, and do pop_walk_state() before it is deleted.
Fixes: 539663bb068f ("ACPICA: Fix use-after-free in acpi_ps_parse_aml()") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> --- drivers/acpi/acpica/dsmethod.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c index 19da7fc73186..cb15c66d5aac 100644 --- a/drivers/acpi/acpica/dsmethod.c +++ b/drivers/acpi/acpica/dsmethod.c @@ -580,8 +580,9 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, /* On error, we must terminate the method properly */ acpi_ds_terminate_control_method(obj_desc, next_walk_state); + if (next_walk_state) + acpi_ds_pop_walk_state(thread); acpi_ds_delete_walk_state(next_walk_state); - acpi_ds_pop_walk_state(thread); return_ACPI_STATUS(status); } -- 2.17.1
| |