lkml.org 
[lkml]   [2022]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] ACPICA: Fix pop_walk_state called after walk_state is deleted
Date
In the previous fix patch acpi_ds_pop_walk_state() is called after
acpi_ds_delete_walk_state() in cleanup, so the problem is not fixed
because it is acpi_ds_pop_walk_state(NULL) called actually.

Also, when acpi_ds_create_walk_state() failed and next_walk_state is
NULL, it pops the normal walk_state_list and make the memory leaked.

Check if next_walk_state is NULL, and do pop_walk_state() before it is
deleted.

Fixes: 539663bb068f ("ACPICA: Fix use-after-free in acpi_ps_parse_aml()")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
---
drivers/acpi/acpica/dsmethod.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 19da7fc73186..cb15c66d5aac 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -580,8 +580,9 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
/* On error, we must terminate the method properly */

acpi_ds_terminate_control_method(obj_desc, next_walk_state);
+ if (next_walk_state)
+ acpi_ds_pop_walk_state(thread);
acpi_ds_delete_walk_state(next_walk_state);
- acpi_ds_pop_walk_state(thread);

return_ACPI_STATUS(status);
}
--
2.17.1
\
 
 \ /
  Last update: 2022-11-07 10:26    [W:0.024 / U:0.516 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site