diff options
| author | Bob Moore <robert.moore@intel.com> | 2009-06-24 11:22:22 +0800 |
|---|---|---|
| committer | Len Brown <len.brown@intel.com> | 2009-08-27 10:17:15 -0400 |
| commit | dbdc8f02fe8339686623c84745ba15b0f4f889a1 (patch) | |
| tree | 2a79c64c8021b06014482e829c153de2b9a7f74c /drivers/acpi | |
| parent | 15b8dd53f5ffaf8e2d9095c423f713423f576c0f (diff) | |
| download | talos-obmc-linux-dbdc8f02fe8339686623c84745ba15b0f4f889a1.tar.gz talos-obmc-linux-dbdc8f02fe8339686623c84745ba15b0f4f889a1.zip | |
ACPICA: Fix possible memory leak in nspredef
Fixed a possible leak when an attempt is made to repair a return
object. The only current repair is an automatic buffer to string
conversion.
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers/acpi')
| -rw-r--r-- | drivers/acpi/acpica/nspredef.c | 27 |
1 files changed, 15 insertions, 12 deletions
diff --git a/drivers/acpi/acpica/nspredef.c b/drivers/acpi/acpica/nspredef.c index 7f8e066b12a3..abbb855e1b9a 100644 --- a/drivers/acpi/acpica/nspredef.c +++ b/drivers/acpi/acpica/nspredef.c @@ -1046,22 +1046,25 @@ acpi_ns_repair_object(u32 expected_btypes, ACPI_MEMCPY(new_object->string.pointer, return_object->buffer.pointer, length); - /* Install the new return object */ - - acpi_ut_remove_reference(return_object); - *return_object_ptr = new_object; - /* - * If the object is a package element, we need to: - * 1. Decrement the reference count of the orignal object, it was - * incremented when building the package - * 2. Increment the reference count of the new object, it will be - * decremented when releasing the package + * If the original object is a package element, we need to: + * 1. Set the reference count of the new object to match the + * reference count of the old object. + * 2. Decrement the reference count of the original object. */ if (package_index != ACPI_NOT_PACKAGE) { - acpi_ut_remove_reference(return_object); - acpi_ut_add_reference(new_object); + new_object->common.reference_count = + return_object->common.reference_count; + + if (return_object->common.reference_count > 1) { + return_object->common.reference_count--; + } } + + /* Delete old object, install the new return object */ + + acpi_ut_remove_reference(return_object); + *return_object_ptr = new_object; return (AE_OK); default: |
