ACPICA: Fix possible memory leak, error exit path

Fixed two possible memory leaks in the error exit paths of
acpi_ut_update_objerct_reference() and
acpi_ut_walk_package_tree()
These functions are similar in that they use a stack of state objects in
order to eliminate recursion. The stack must be fully deallocated
if an error occurs.

http://www.acpica.org/bugzilla/show_bug.cgi?id=383

Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>

diff --git a/drivers/acpi/utilities/utdelete.c b/drivers/acpi/utilities/utdelete.c
index 5c219758c226ce283117733af39a4479b752e77f..d197c6b29e170e2381e2fcd0765c4368e090121a 100644 (file)
--- a/drivers/acpi/utilities/utdelete.c
+++ b/drivers/acpi/utilities/utdelete.c
@@ -585,6 +585,13 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
        ACPI_EXCEPTION((AE_INFO, status,
                        "Could not update object reference count"));
 
+       /* Free any stacked Update State objects */
+
+       while (state_list) {
+               state = acpi_ut_pop_generic_state(&state_list);
+               acpi_ut_delete_generic_state(state);
+       }
+
        return_ACPI_STATUS(status);
 }
 

diff --git a/drivers/acpi/utilities/utmisc.c b/drivers/acpi/utilities/utmisc.c
index f34be6773556beebd53f3dde5f63bc03a78e07cf..9089a158a8740c4fd47d5b75d56c6b3d6e350e67 100644 (file)
--- a/drivers/acpi/utilities/utmisc.c
+++ b/drivers/acpi/utilities/utmisc.c
@@ -995,6 +995,15 @@ acpi_ut_walk_package_tree(union acpi_operand_object * source_object,
                                                         state->pkg.
                                                         this_target_obj, 0);
                        if (!state) {
+
+                               /* Free any stacked Update State objects */
+
+                               while (state_list) {
+                                       state =
+                                           acpi_ut_pop_generic_state
+                                           (&state_list);
+                                       acpi_ut_delete_generic_state(state);
+                               }
                                return_ACPI_STATUS(AE_NO_MEMORY);
                        }
                }