diff options
| author | Lin Ming <ming.m.lin@intel.com> | 2008-09-27 11:29:57 +0800 |
|---|---|---|
| committer | Len Brown <len.brown@intel.com> | 2008-10-22 23:14:47 -0400 |
| commit | cf058bd1c84df9921ecc517d8a8a413f4d6b5b45 (patch) | |
| tree | ca9cc1f367f96a13e60047c88a0e41f284274c71 /drivers/acpi | |
| parent | c35def2118d3d7cceb0f69d6707f613a7473df15 (diff) | |
| download | linux-cf058bd1c84df9921ecc517d8a8a413f4d6b5b45.tar.bz2 | |
ACPICA: Fix possible memory leak, error exit path
Fixed two possible memory leaks in the error exit paths of
acpi_ut_update_objerct_reference() and
acpi_ut_walk_package_tree()
These functions are similar in that they use a stack of state objects in
order to eliminate recursion. The stack must be fully deallocated
if an error occurs.
http://www.acpica.org/bugzilla/show_bug.cgi?id=383
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers/acpi')
| -rw-r--r-- | drivers/acpi/utilities/utdelete.c | 7 | ||||
| -rw-r--r-- | drivers/acpi/utilities/utmisc.c | 9 |
2 files changed, 16 insertions, 0 deletions
diff --git a/drivers/acpi/utilities/utdelete.c b/drivers/acpi/utilities/utdelete.c index 5c219758c226..d197c6b29e17 100644 --- a/drivers/acpi/utilities/utdelete.c +++ b/drivers/acpi/utilities/utdelete.c @@ -585,6 +585,13 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) ACPI_EXCEPTION((AE_INFO, status, "Could not update object reference count")); + /* Free any stacked Update State objects */ + + while (state_list) { + state = acpi_ut_pop_generic_state(&state_list); + acpi_ut_delete_generic_state(state); + } + return_ACPI_STATUS(status); } diff --git a/drivers/acpi/utilities/utmisc.c b/drivers/acpi/utilities/utmisc.c index f34be6773556..9089a158a874 100644 --- a/drivers/acpi/utilities/utmisc.c +++ b/drivers/acpi/utilities/utmisc.c @@ -995,6 +995,15 @@ acpi_ut_walk_package_tree(union acpi_operand_object * source_object, state->pkg. this_target_obj, 0); if (!state) { + + /* Free any stacked Update State objects */ + + while (state_list) { + state = + acpi_ut_pop_generic_state + (&state_list); + acpi_ut_delete_generic_state(state); + } return_ACPI_STATUS(AE_NO_MEMORY); } } |