[PATCH v1 11/30] ACPICA: Improve error handling in table loading process

[Pawel Chmielewski]

From: ikaros <void0red@xxxxxxxxx>

The AML Load operator can install a table that acpi_tb_load_table()
then fails to load. In that case acpi_tb_install_and_load_table()
returns an error but leaves the table descriptor in
acpi_gbl_root_table_list. acpi_ex_load_op() then frees the table
buffer, so the descriptor still points to freed memory. Later users of
the table list access the freed table. For example,
acpi_tb_terminate() does when it uninstalls all tables.

When loading fails, uninstall the table in
acpi_tb_install_and_load_table(). For internally allocated tables this
also frees the table buffer, so acpi_ex_load_op() must stop freeing it.

Link: https://github.com/acpica/acpica/commit/d243755c4750
Closes: https://github.com/open-acpica/acpica/issues/1173
Signed-off-by: ikaros <void0red@xxxxxxxxx>
Signed-off-by: Pawel Chmielewski <pawel.chmielewski@xxxxxxxxx>
---
 drivers/acpi/acpica/exconfig.c | 9 ++++++---
 drivers/acpi/acpica/tbdata.c   | 6 ++++++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/acpi/acpica/exconfig.c b/drivers/acpi/acpica/exconfig.c
index da39d578595b..cb2eed531c67 100644
--- a/drivers/acpi/acpica/exconfig.c
+++ b/drivers/acpi/acpica/exconfig.c
@@ -461,9 +461,12 @@ acpi_ex_load_op(union acpi_operand_object *obj_desc,
 	acpi_ex_enter_interpreter();
 	if (ACPI_FAILURE(status)) {
 
-		/* Delete allocated table buffer */
-
-		ACPI_FREE(table);
+		/*
+		 * Table buffer is already freed by acpi_tb_uninstall_table
+		 * in acpi_tb_install_and_load_table if installation succeeded,
+		 * or by acpi_tb_uninstall_table in acpi_tb_install_standard_table
+		 * if verification failed after partial setup.
+		 */
 		return_ACPI_STATUS(status);
 	}
 
diff --git a/drivers/acpi/acpica/tbdata.c b/drivers/acpi/acpica/tbdata.c
index 1388d484787f..d5627b12b1d0 100644
--- a/drivers/acpi/acpica/tbdata.c
+++ b/drivers/acpi/acpica/tbdata.c
@@ -1019,6 +1019,12 @@ acpi_tb_install_and_load_table(acpi_physical_address address,
 	}
 
 	status = acpi_tb_load_table(i, acpi_gbl_root_node);
+	if (ACPI_FAILURE(status)) {
+		/* Table was installed but not loaded, uninstall to clean up */
+
+		acpi_tb_uninstall_table(&acpi_gbl_root_table_list.tables[i]);
+		goto exit;
+	}
 
 exit:
 	*table_index = i;
-- 
2.50.1