Commit 4faa095b authored by Armin Wolf's avatar Armin Wolf Committed by Qi Xi
Browse files

ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails 

stable inclusion
from stable-v4.19.323
commit b017675cfbd126954d3b45afbdd6ee345a0ce368
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBBN6V

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b017675cfbd126954d3b45afbdd6ee345a0ce368

--------------------------------

[ Upstream commit 5accb265f7a1b23e52b0ec42313d1e12895552f4 ]

ACPICA commit 2802af722bbde7bf1a7ac68df68e179e2555d361

If acpi_ps_get_next_namepath() fails, the previously allocated
union acpi_parse_object needs to be freed before returning the
status code.

The issue was first being reported on the Linux ACPI mailing list:

Link: https://lore.kernel.org/linux-acpi/56f94776-484f-48c0-8855-dba8e6a7793b@yandex.ru/T/
Link: https://github.com/acpica/acpica/commit/2802af72


Signed-off-by: default avatarArmin Wolf <W_Armin@gmx.de>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarQi Xi <xiqi2@huawei.com>
parent 24564bb8

drivers/acpi/acpica/psargs.c

+8 −0
Original line number Diff line number Diff line
@@ -820,6 +820,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state, 
			    acpi_ps_get_next_namepath(walk_state, parser_state,

						      arg,

						      ACPI_NOT_METHOD_CALL);

			if (ACPI_FAILURE(status)) {

				acpi_ps_free_op(arg);

				return_ACPI_STATUS(status);

			}

		} else {

			/* Single complex argument, nothing returned */
@@ -854,6 +858,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state, 
			    acpi_ps_get_next_namepath(walk_state, parser_state,

						      arg,

						      ACPI_POSSIBLE_METHOD_CALL);

			if (ACPI_FAILURE(status)) {

				acpi_ps_free_op(arg);

				return_ACPI_STATUS(status);

			}



			if (arg->common.aml_opcode == AML_INT_METHODCALL_OP) {