Commit c44ef150 authored by Pei Xiao's avatar Pei Xiao Committed by Qi Xi
Browse files

ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() 

stable inclusion
from stable-v4.19.323
commit 4669da66ebc5b09881487f30669b0fcdb462188e
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBBN6V

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4669da66ebc5b09881487f30669b0fcdb462188e

--------------------------------

[ Upstream commit a5242874488eba2b9062985bf13743c029821330 ]

ACPICA commit 4d4547cf13cca820ff7e0f859ba83e1a610b9fd0

ACPI_ALLOCATE_ZEROED() may fail, elements might be NULL and will cause
NULL pointer dereference later.

Link: https://github.com/acpica/acpica/commit/4d4547cf


Signed-off-by: default avatarPei Xiao <xiaopei01@kylinos.cn>
Link: https://patch.msgid.link/tencent_4A21A2865B8B0A0D12CAEBEB84708EDDB505@qq.com


[ rjw: Subject and changelog edits ]
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarQi Xi <xiqi2@huawei.com>
parent 15e7130d

drivers/acpi/acpica/dbconvert.c

+2 −0
Original line number Diff line number Diff line
@@ -170,6 +170,8 @@ acpi_status acpi_db_convert_to_package(char *string, union acpi_object *object) 
	elements =

	    ACPI_ALLOCATE_ZEROED(DB_DEFAULT_PKG_ELEMENTS *

				 sizeof(union acpi_object));

	if (!elements)

		return (AE_NO_MEMORY);



	this = string;

	for (i = 0; i < (DB_DEFAULT_PKG_ELEMENTS - 1); i++) {