lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 17 Jan 2022 21:39:42 -0500 From: Sasha Levin <sashal@...nel.org> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org Cc: "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>, Mark Asselstine <mark.asselstine@...driver.com>, Bob Moore <robert.moore@...el.com>, Sasha Levin <sashal@...nel.org>, linux-acpi@...r.kernel.org, devel@...ica.org Subject: [PATCH AUTOSEL 5.10 091/116] ACPICA: Utilities: Avoid deleting the same object twice in a row From: "Rafael J. Wysocki" <rafael.j.wysocki@...el.com> [ Upstream commit 1cdfe9e346b4c5509ffe19ccde880fd259d9f7a3 ] ACPICA commit c11af67d8f7e3d381068ce7771322f2b5324d687 If original_count is 0 in acpi_ut_update_ref_count (), acpi_ut_delete_internal_obj () is invoked for the target object, which is incorrect, because that object has been deleted once already and the memory allocated to store it may have been reclaimed and allocated for a different purpose by the host OS. Moreover, a confusing debug message following the "Reference Count is already zero, cannot decrement" warning is printed in that case. To fix this issue, make acpi_ut_update_ref_count () return after finding that original_count is 0 and printing the above warning. Link: https://github.com/acpica/acpica/commit/c11af67d Link: https://github.com/acpica/acpica/pull/652 Reported-by: Mark Asselstine <mark.asselstine@...driver.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@...el.com> Signed-off-by: Bob Moore <robert.moore@...el.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@...el.com> Signed-off-by: Sasha Levin <sashal@...nel.org> --- drivers/acpi/acpica/utdelete.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c index 72d2c0b656339..cb1750e7a6281 100644 --- a/drivers/acpi/acpica/utdelete.c +++ b/drivers/acpi/acpica/utdelete.c @@ -422,6 +422,7 @@ acpi_ut_update_ref_count(union acpi_operand_object *object, u32 action) ACPI_WARNING((AE_INFO, "Obj %p, Reference Count is already zero, cannot decrement\n", object)); + return; } ACPI_DEBUG_PRINT_RAW((ACPI_DB_ALLOCATIONS, -- 2.34.1
Powered by blists - more mailing lists