Re: [PATCH] ACPICA: cleanup method properly on error

[Vegard Nossum <vegard.nossum@oracle.com>]

On 07/26/2016 10:28 PM, Moore, Robert wrote:
>      /* Put the new state at the head of the walk list */
>
>      if (Thread)
>      {
>          AcpiDsPushWalkState (WalkState, Thread);
>      }
>
> Is there any chance that Thread could be zero?

I'm not sure if this question was for me or not, but that code (modulo
the capitalisation differences) is the reason why I also used 'if
(thread)' in my patch.


Vegard

>
>> -----Original Message-----
>> From: Devel [mailto:devel-bounces@acpica.org] On Behalf Of Moore, Robert
>> Sent: Tuesday, July 26, 2016 7:40 AM
>> To: Vegard Nossum <vegard.nossum@oracle.com>; Zheng, Lv
>> <lv.zheng@intel.com>; Wysocki, Rafael J <rafael.j.wysocki@intel.com>
>> Cc: linux-acpi@vger.kernel.org; linux-kernel@vger.kernel.org;
>> stable@vger.kernel.org; devel@acpica.org
>> Subject: Re: [Devel] [PATCH] ACPICA: cleanup method properly on error
>>
>> We'll look at this.
>> Thanks.
>>
>>
>>> -----Original Message-----
>>> From: Vegard Nossum [mailto:vegard.nossum@oracle.com]
>>> Sent: Friday, July 22, 2016 8:35 AM
>>> To: Moore, Robert <robert.moore@intel.com>; Zheng, Lv
>>> <lv.zheng@intel.com>; Wysocki, Rafael J <rafael.j.wysocki@intel.com>
>>> Cc: linux-acpi@vger.kernel.org; devel@acpica.org; linux-
>>> kernel@vger.kernel.org; Vegard Nossum <vegard.nossum@oracle.com>;
>>> stable@vger.kernel.org
>>> Subject: [PATCH] ACPICA: cleanup method properly on error
>>>
>>> If the call to acpi_ds_init_aml_walk() fails, then we have to undo the
>>> walk state push done by acpi_ds_create_walk_state(). Otherwise, the
>>> new walk state (which has just been freed) will remain on the thread's
>>> walk_state_list and be dereferenced in acpi_ps_parse_aml() when we try
>>> to get the new state.
>>>
>>> You can observe this when reading e.g.
>>>
>>>      /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:01/status
>>>
>>> Cc: stable@vger.kernel.org
>>> Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
>>> ---
>>>   drivers/acpi/acpica/dsmethod.c | 2 ++
>>>   1 file changed, 2 insertions(+)
>>>
>>> diff --git a/drivers/acpi/acpica/dsmethod.c
>>> b/drivers/acpi/acpica/dsmethod.c index 47c7b52..44b50a6 100644
>>> --- a/drivers/acpi/acpica/dsmethod.c
>>> +++ b/drivers/acpi/acpica/dsmethod.c
>>> @@ -596,6 +596,8 @@ cleanup:
>>>   	/* On error, we must terminate the method properly */
>>>
>>>   	acpi_ds_terminate_control_method(obj_desc, next_walk_state);
>>> +	if (thread)
>>> +		acpi_ds_pop_walk_state(thread);
>>>   	acpi_ds_delete_walk_state(next_walk_state);
>>>
>>>   	return_ACPI_STATUS(status);
>>> --
>>> 1.9.1
>>
>> _______________________________________________
>> Devel mailing list
>> Devel@acpica.org
>> https://lists.acpica.org/mailman/listinfo/devel