Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8410565f authored by Bob Moore's avatar Bob Moore Committed by Len Brown
Browse files

ACPICA: Fix for access to deleted object <regression> 

Fixes problem introduced in 20080123, with fix for Unload operator.
Parse tree object can be already deleted; must use the opcode
within the WalkState.

ACPI: kmemcheck: Caught 16-bit read from freed memory
http://bugzilla.kernel.org/show_bug.cgi?id=10669



Signed-off-by: default avatarLin Ming <ming.m.lin@intel.com>
Signed-off-by: default avatarBob Moore <robert.moore@intel.com>
Signed-off-by: default avatarLen Brown <len.brown@intel.com>
parent d52c79ac

drivers/acpi/parser/psargs.c

+2 −2
Original line number Diff line number Diff line
@@ -268,7 +268,7 @@ acpi_ps_get_next_namepath(struct acpi_walk_state *walk_state, 
	 */

	if (ACPI_SUCCESS(status) &&

	    possible_method_call && (node->type == ACPI_TYPE_METHOD)) {

		if (walk_state->op->common.aml_opcode == AML_UNLOAD_OP) {

		if (walk_state->opcode == AML_UNLOAD_OP) {

			/*

			 * acpi_ps_get_next_namestring has increased the AML pointer,

			 * so we need to restore the saved AML pointer for method call.
@@ -691,7 +691,7 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state, 


			/* To support super_name arg of Unload */



			if (walk_state->op->common.aml_opcode == AML_UNLOAD_OP) {

			if (walk_state->opcode == AML_UNLOAD_OP) {

				status =

				    acpi_ps_get_next_namepath(walk_state,

							      parser_state, arg,