From: Lv Zheng Date: Fri, 4 Apr 2014 04:38:35 +0000 (+0800) Subject: ACPICA: Tables: Fix multiple ACPI_FREE()s around acpi_tb_add_table(). X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=55df23f0d620c5194ecbd3b68ecdb2798778bf93;p=linux-beck.git ACPICA: Tables: Fix multiple ACPI_FREE()s around acpi_tb_add_table(). Currently there are following issues in acpi_tb_add_table(): Following logic is currently correct: 1. When a table is allocated in acpi_ex_load_op(), if a reloading happens, the allocated memory is freed by acpi_tb_add_table() and AE_OK is returned to the caller to avoid the caller to free it again. Following logic is currently incorrect: 1. When a table is allocated in acpi_ex_load_op() or by the acpi_load_table() caller, if the table is already loaded, there will be twice ACPI_FREE() called for the same pointer when acpi_tb_add_table() returns AE_ALREADY_EXISTS. This patch only fixes the above incorrect logic in acpi_tb_add_table(): 1. Only invoke acpi_tb_delete_table() if AE_OK is going to be returned. 2. After doing so, we do not invoke ACPI_FREE() when returning AE_OK; Signed-off-by: Lv Zheng Signed-off-by: Bob Moore [rjw: Subject] Signed-off-by: Rafael J. Wysocki --- diff --git a/drivers/acpi/acpica/exconfig.c b/drivers/acpi/acpica/exconfig.c index 649a8efef0f5..11a014ca3935 100644 --- a/drivers/acpi/acpica/exconfig.c +++ b/drivers/acpi/acpica/exconfig.c @@ -504,7 +504,7 @@ acpi_ex_load_op(union acpi_operand_object *obj_desc, /* Delete allocated table buffer */ - acpi_tb_delete_table(&table_desc); + ACPI_FREE(table_desc.pointer); return_ACPI_STATUS(status); } diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c index 144076ac21f0..0040e19b6d14 100644 --- a/drivers/acpi/acpica/tbinstal.c +++ b/drivers/acpi/acpica/tbinstal.c @@ -203,12 +203,6 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc, u32 *table_index) * need to be unregistered when they are unloaded, and slots in the * root table list should be reused when empty. */ - - /* - * Table is already registered. - * We can delete the table that was passed as a parameter. - */ - acpi_tb_delete_table(table_desc); *table_index = i; if (acpi_gbl_root_table_list.tables[i]. @@ -221,6 +215,7 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc, u32 *table_index) } else { /* Table was unloaded, allow it to be reloaded */ + acpi_tb_delete_table(table_desc); table_desc->pointer = acpi_gbl_root_table_list.tables[i].pointer; table_desc->address =