Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b340de28 authored by Armin Wolf's avatar Armin Wolf Committed by Greg Kroah-Hartman
Browse files

ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails 

[ Upstream commit 5accb265f7a1b23e52b0ec42313d1e12895552f4 ]

ACPICA commit 2802af722bbde7bf1a7ac68df68e179e2555d361

If acpi_ps_get_next_namepath() fails, the previously allocated
union acpi_parse_object needs to be freed before returning the
status code.

The issue was first being reported on the Linux ACPI mailing list:

Link: https://lore.kernel.org/linux-acpi/56f94776-484f-48c0-8855-dba8e6a7793b@yandex.ru/T/
Link: https://github.com/acpica/acpica/commit/2802af72


Signed-off-by: default avatarArmin Wolf <W_Armin@gmx.de>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 62c0d526

drivers/acpi/acpica/psargs.c

+8 −0
Original line number Diff line number Diff line
@@ -820,6 +820,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state, 
			    acpi_ps_get_next_namepath(walk_state, parser_state,

						      arg,

						      ACPI_NOT_METHOD_CALL);

			if (ACPI_FAILURE(status)) {

				acpi_ps_free_op(arg);

				return_ACPI_STATUS(status);

			}

		} else {

			/* Single complex argument, nothing returned */
@@ -854,6 +858,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state, 
			    acpi_ps_get_next_namepath(walk_state, parser_state,

						      arg,

						      ACPI_POSSIBLE_METHOD_CALL);

			if (ACPI_FAILURE(status)) {

				acpi_ps_free_op(arg);

				return_ACPI_STATUS(status);

			}



			if (arg->common.aml_opcode == AML_INT_METHODCALL_OP) {