From patchwork Fri Jul 22 15:35:09 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vegard Nossum X-Patchwork-Id: 9243793 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2C663602F0 for ; Fri, 22 Jul 2016 15:35:23 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1DC542624D for ; Fri, 22 Jul 2016 15:35:23 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 10B5827FA5; Fri, 22 Jul 2016 15:35:23 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8E9752624D for ; Fri, 22 Jul 2016 15:35:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751914AbcGVPfV (ORCPT ); Fri, 22 Jul 2016 11:35:21 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:22512 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751830AbcGVPfU (ORCPT ); Fri, 22 Jul 2016 11:35:20 -0400 Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id u6MFZGL4020438 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 22 Jul 2016 15:35:16 GMT Received: from lenuta.oracle.com (dhcp-ukc1-twvpn-1-vpnpool-10-175-172-243.vpn.oracle.com [10.175.172.243]) by aserv0021.oracle.com (8.13.8/8.13.8) with ESMTP id u6MFZEHC026775; Fri, 22 Jul 2016 15:35:14 GMT From: Vegard Nossum To: Robert Moore , Lv Zheng , "Rafael J. Wysocki" Cc: linux-acpi@vger.kernel.org, devel@acpica.org, linux-kernel@vger.kernel.org, Vegard Nossum , stable@vger.kernel.org Subject: [PATCH] ACPICA: cleanup method properly on error Date: Fri, 22 Jul 2016 17:35:09 +0200 Message-Id: <1469201709-10518-1-git-send-email-vegard.nossum@oracle.com> X-Mailer: git-send-email 1.9.1 X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-acpi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-acpi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If the call to acpi_ds_init_aml_walk() fails, then we have to undo the walk state push done by acpi_ds_create_walk_state(). Otherwise, the new walk state (which has just been freed) will remain on the thread's walk_state_list and be dereferenced in acpi_ps_parse_aml() when we try to get the new state. You can observe this when reading e.g. /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:01/status Cc: stable@vger.kernel.org Signed-off-by: Vegard Nossum --- drivers/acpi/acpica/dsmethod.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c index 47c7b52..44b50a6 100644 --- a/drivers/acpi/acpica/dsmethod.c +++ b/drivers/acpi/acpica/dsmethod.c @@ -596,6 +596,8 @@ cleanup: /* On error, we must terminate the method properly */ acpi_ds_terminate_control_method(obj_desc, next_walk_state); + if (thread) + acpi_ds_pop_walk_state(thread); acpi_ds_delete_walk_state(next_walk_state); return_ACPI_STATUS(status);