ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject
authorDavid E. Box <david.e.box@linux.intel.com>
Tue, 8 Jul 2014 02:05:52 +0000 (10:05 +0800)
committerRafael J. Wysocki <rafael.j.wysocki@intel.com>
Tue, 8 Jul 2014 12:22:24 +0000 (14:22 +0200)
Adds return status check on copy routines to delete the allocated destination
object if either copy fails. Reported by Colin Ian King on bugs.acpica.org,
Bug 1087.
The last applicable commit:
 Commit: 3371c19c294a4cb3649aa4e84606be8a1d999e61
 Subject: ACPICA: Remove ACPI_GET_OBJECT_TYPE macro

Link: https://bugs.acpica.org/show_bug.cgi?id=1087
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David E. Box <david.e.box@linux.intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Cc: 3.9+ <stable@vger.kernel.org> # 3.9+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
drivers/acpi/acpica/utcopy.c

index 270c16464dd948181f98755f8e1f13809c9acf13..ff601c0f7c7a0024048f2e2d10478c6a7104ad13 100644 (file)
@@ -1001,5 +1001,11 @@ acpi_ut_copy_iobject_to_iobject(union acpi_operand_object *source_desc,
                status = acpi_ut_copy_simple_object(source_desc, *dest_desc);
        }
 
+       /* Delete the allocated object if copy failed */
+
+       if (ACPI_FAILURE(status)) {
+               acpi_ut_remove_reference(*dest_desc);
+       }
+
        return_ACPI_STATUS(status);
 }