ACPICA: Fix for possible memory leak and fault.

Fixed a possible memory leak and fault in acpi_ex_resolve_object_to_value()
during a read from a buffer or region field. (BZ 458)

Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Alexey Starikovskiy <alexey.y.starikovskiy@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>

diff --git a/drivers/acpi/executer/exresolv.c b/drivers/acpi/executer/exresolv.c
index 6499de8..fa17f55 100644 (file)
--- a/drivers/acpi/executer/exresolv.c
+++ b/drivers/acpi/executer/exresolv.c
@@ -141,7 +141,7 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr,
        acpi_status status = AE_OK;
        union acpi_operand_object *stack_desc;
        void *temp_node;
-       union acpi_operand_object *obj_desc;
+       union acpi_operand_object *obj_desc = NULL;
        u16 opcode;
 
        ACPI_FUNCTION_TRACE(ex_resolve_object_to_value);
@@ -299,8 +299,6 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr,
                status = acpi_ds_get_package_arguments(stack_desc);
                break;
 
-               /* These cases may never happen here, but just in case.. */
-
        case ACPI_TYPE_BUFFER_FIELD:
        case ACPI_TYPE_LOCAL_REGION_FIELD:
        case ACPI_TYPE_LOCAL_BANK_FIELD:
@@ -314,6 +312,10 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr,
                status =
                    acpi_ex_read_data_from_field(walk_state, stack_desc,
                                                 &obj_desc);
+
+               /* Remove a reference to the original operand, then override */
+
+               acpi_ut_remove_reference(*stack_ptr);
                *stack_ptr = (void *)obj_desc;
                break;