RE: [PATCH] ACPICA: cleanup method properly on error

[Moore, Robert]

We'll look at this.
Thanks.


> -----Original Message-----
> From: Vegard Nossum [mailto:vegard.nossum@xxxxxxxxxx]
> Sent: Friday, July 22, 2016 8:35 AM
> To: Moore, Robert <robert.moore@xxxxxxxxx>; Zheng, Lv
> <lv.zheng@xxxxxxxxx>; Wysocki, Rafael J <rafael.j.wysocki@xxxxxxxxx>
> Cc: linux-acpi@xxxxxxxxxxxxxxx; devel@xxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; Vegard Nossum <vegard.nossum@xxxxxxxxxx>;
> stable@xxxxxxxxxxxxxxx
> Subject: [PATCH] ACPICA: cleanup method properly on error
> 
> If the call to acpi_ds_init_aml_walk() fails, then we have to undo the
> walk state push done by acpi_ds_create_walk_state(). Otherwise, the new
> walk state (which has just been freed) will remain on the thread's
> walk_state_list and be dereferenced in acpi_ps_parse_aml() when we try
> to get the new state.
> 
> You can observe this when reading e.g.
> 
>     /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:01/status
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Vegard Nossum <vegard.nossum@xxxxxxxxxx>
> ---
>  drivers/acpi/acpica/dsmethod.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/acpi/acpica/dsmethod.c
> b/drivers/acpi/acpica/dsmethod.c index 47c7b52..44b50a6 100644
> --- a/drivers/acpi/acpica/dsmethod.c
> +++ b/drivers/acpi/acpica/dsmethod.c
> @@ -596,6 +596,8 @@ cleanup:
>  	/* On error, we must terminate the method properly */
> 
>  	acpi_ds_terminate_control_method(obj_desc, next_walk_state);
> +	if (thread)
> +		acpi_ds_pop_walk_state(thread);
>  	acpi_ds_delete_walk_state(next_walk_state);
> 
>  	return_ACPI_STATUS(status);
> --
> 1.9.1