From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B9DD2127E6; Wed, 25 Sep 2024 12:12:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1727266338; cv=none; b=RyLFEs1pHACqXzQNvat4I6Dsrxj2vbdHJTCl2YxYqoqKmjJ5Q3wLArWQuiJ1i1dUbd3Brh3qhEa39qanDA1kYKVhjwOkxRSKi4Wqa0G7574vMY9GpCyEVy4X9egFBK/AhXfVo2LhxOEjDHwrNPE2jHIR7+lz1aaSFM+5ufJSBoE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1727266338; c=relaxed/simple; bh=c4FGg+Mkb3VqwAyZ2q6Ojfr+niwT1uXN5adRPOU7VtY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VgWiUuLeCWAJwPxvT3lJbbmUUb18CIfF3o9jscKSSAy22Pkt0e/AYlQqXX4NAI/uSAa2SFORwGCh3e2zkyO7QYN46MkOI06kHh+j8VdfQOKo3fW9o1od8+eo8TlI1jWa+4MgSvWjV/gKIXi0paT5e7VK1F4fPuG4nkYGnLTrCEk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=uvsYNxqj; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="uvsYNxqj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DB1CFC4CECD; Wed, 25 Sep 2024 12:12:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1727266337; bh=c4FGg+Mkb3VqwAyZ2q6Ojfr+niwT1uXN5adRPOU7VtY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uvsYNxqjv7Ma1hc0A2nOnoZ39yUr+PJS44Iu0Ke6U0qpcvpzLzHTUPNBexxdUgRSB YkxwHRJ+wXPuR4GC1HXHmG1nyQlq6THQwnwEgP0/50tOg6uJ2W7tJbTfHvIgDSaX8r vYJ+l/Ey5zgPr276fgDR2KmnE/d3pv43/0s2Fqwmhz1tX+G3QilL3JS4jFuRA1SpCc 6HkoRr02ojBnPIbEdcFGMqmvYG9OGRs6xZvrQ/C7JAN3fCbRlTQGGgl/Is3T9k2pTV TJFz3/V0TROdhGGs9bH+HwRydJgnV2DWZKGcnWsjgpSK6U1YLvmnCg008CfkFm6Kz8 1VKqjcBI0A7rQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Armin Wolf , "Rafael J . Wysocki" , Sasha Levin , robert.moore@intel.com, linux-acpi@vger.kernel.org, acpica-devel@lists.linux.dev Subject: [PATCH AUTOSEL 6.6 017/139] ACPICA: Fix memory leak if acpi_ps_get_next_field() fails Date: Wed, 25 Sep 2024 08:07:17 -0400 Message-ID: <20240925121137.1307574-17-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240925121137.1307574-1-sashal@kernel.org> References: <20240925121137.1307574-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.6.52 Content-Transfer-Encoding: 8bit From: Armin Wolf [ Upstream commit e6169a8ffee8a012badd8c703716e761ce851b15 ] ACPICA commit 1280045754264841b119a5ede96cd005bc09b5a7 If acpi_ps_get_next_field() fails, the previously created field list needs to be properly disposed before returning the status code. Link: https://github.com/acpica/acpica/commit/12800457 Signed-off-by: Armin Wolf [ rjw: Rename local variable to avoid compiler confusion ] Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin --- drivers/acpi/acpica/psargs.c | 39 ++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c index 7debfd5ce0d86..28582adfc0aca 100644 --- a/drivers/acpi/acpica/psargs.c +++ b/drivers/acpi/acpica/psargs.c @@ -25,6 +25,8 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state); static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state *parser_state); +static void acpi_ps_free_field_list(union acpi_parse_object *start); + /******************************************************************************* * * FUNCTION: acpi_ps_get_next_package_length @@ -683,6 +685,39 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state return_PTR(field); } +/******************************************************************************* + * + * FUNCTION: acpi_ps_free_field_list + * + * PARAMETERS: start - First Op in field list + * + * RETURN: None. + * + * DESCRIPTION: Free all Op objects inside a field list. + * + ******************************************************************************/ + +static void acpi_ps_free_field_list(union acpi_parse_object *start) +{ + union acpi_parse_object *cur = start; + union acpi_parse_object *next; + union acpi_parse_object *arg; + + while (cur) { + next = cur->common.next; + + /* AML_INT_CONNECTION_OP can have a single argument */ + + arg = acpi_ps_get_arg(cur, 0); + if (arg) { + acpi_ps_free_op(arg); + } + + acpi_ps_free_op(cur); + cur = next; + } +} + /******************************************************************************* * * FUNCTION: acpi_ps_get_next_arg @@ -751,6 +786,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state, while (parser_state->aml < parser_state->pkg_end) { field = acpi_ps_get_next_field(parser_state); if (!field) { + if (arg) { + acpi_ps_free_field_list(arg); + } + return_ACPI_STATUS(AE_NO_MEMORY); } -- 2.43.0