diff options
| author | Bob Moore | 2014-02-26 10:33:47 +0800 |
|---|---|---|
| committer | Rafael J. Wysocki | 2014-03-18 01:52:18 +0100 |
| commit | f953529f3b659a72c0982c2cf195158db96361f1 (patch) | |
| tree | 48eeb4fe487c2c0c82add70e8b71edea9a14f37d /drivers/acpi/acpica/nsobject.c | |
| parent | a487af33a4f0f5ced860ab18c4a740b97b435a3e (diff) | |
ACPICA: Prevent infinite loops when traversing corrupted lists.
This change hardens the ACPICA code to detect circular linked object
lists and prevent an infinite loop if such corruption exists.
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Diffstat (limited to 'drivers/acpi/acpica/nsobject.c')
| -rw-r--r-- | drivers/acpi/acpica/nsobject.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/acpi/acpica/nsobject.c b/drivers/acpi/acpica/nsobject.c index 32845b105053..fe54a8c73b8c 100644 --- a/drivers/acpi/acpica/nsobject.c +++ b/drivers/acpi/acpica/nsobject.c @@ -222,13 +222,19 @@ void acpi_ns_detach_object(struct acpi_namespace_node *node) } } - /* Clear the entry in all cases */ + /* Clear the Node entry in all cases */ node->object = NULL; if (ACPI_GET_DESCRIPTOR_TYPE(obj_desc) == ACPI_DESC_TYPE_OPERAND) { + + /* Unlink object from front of possible object list */ + node->object = obj_desc->common.next_object; + + /* Handle possible 2-descriptor object */ + if (node->object && - ((node->object)->common.type != ACPI_TYPE_LOCAL_DATA)) { + (node->object->common.type != ACPI_TYPE_LOCAL_DATA)) { node->object = node->object->common.next_object; } } |