Received-SPF: pass (google.com: domain of linux-kernel+bounces-128900-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Armin Wolf <W_Armin@gmx.de>
To: robert.moore@intel.com,
	rafael.j.wysocki@intel.com,
	lenb@kernel.org
Cc: dmantipov@yandex.ru,
	linux-acpi@vger.kernel.org,
	acpica-devel@lists.linux.dev,
	linux-kernel@vger.kernel.org
Subject: [PATCH] ACPICA: Fix memory leak then namespace lookup fails
Date: Wed,  3 Apr 2024 02:47:18 +0200
Message-Id: <20240403004718.11902-1-W_Armin@gmx.de>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:icUtJdfJZeM=;kfGPWYFf7109ebjlp50NjFzPt+1
 sZWGNPsf/k5ubapg6s1UkJKbobX0InlykQgHs7STQywpZqXent1KsshMDMBgUhjQPBMcfSSF2
 6GWilxktOsotEG3x/JlwrOvcFJIk2/feS1J6DCH9kIXcnwubCN2bPjOiFL1TaxO6qxOoUvDvY
 SH5bknShaqBK4+06uuh80mVwzA+xcM5B6LLuTMt6AtawAwdmsty2dHBZI/0OHCX3+gtLSUX7K
 KAYtCY0GaCq52OdGYG5tcu5mTd5O0EZ8C3JdhWsFzK2+lPvT26844ooqPG00Ha4vwBao95h8K
 zP+RC/yYqYA0Yvrcezjs52VA2jA5hx7viCabDq6PUFiTwZRqWbv/hx5wAlJmV02vAxRa+dOMJ
 U40bjiuZdyzasARKQEPXaoJsCKOn9KqEOHZQQ8Vk28DnIRa6e5cv+buDKGMh84BaAL7BTfwE0
 4dJMExhjLrmrCgpUCyml8Mkid1j0StCUobbl98rileu0cKytdgY5FnFh6xJroAoAVW1LUn/2X
 3XvbJ9gDZ/1QhgqXeygV0kktS00GHHxNeakbMRHBctalhmQebOvkMV1mvPu2gJTxJ/l3i3QZ7
 NXveWrmcKJ3e8enpxplblq6QdKzVPVMGsSHwght1AhLlqxGLrm/eLq9Eirn/IWJizx8B+NV6R
 VQqCdmbzkwTIYSNfKVObuJQ7e+GJGyZiIJEy0bMK5ZKr3iNEltc/wjYcZwF3Qc/+WKsPE3WvY
 e2r5QJNHGChJr3Ez5iGnqYNwAM+fWTXfl6R7COFEA2MZsunjTLzDN5VJ0DYzA6lN0+5XqaOuu
 rwija1eWrs8dMMC5J8GS8Hc2J10D03RGLi+EaAaGNYdpM=

When acpi_ps_get_next_namepath() fails due to a namespace lookup
failure, the acpi_parse_object is not freed before returning the
error code, causing a memory leak.

Fix this by freeing the acpi_parse_object when encountering an
error.

Tested-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
=2D--
 drivers/acpi/acpica/psargs.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 422c074ed289..7debfd5ce0d8 100644
=2D-- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -820,6 +820,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_sta=
te,
 			    acpi_ps_get_next_namepath(walk_state, parser_state,
 						      arg,
 						      ACPI_NOT_METHOD_CALL);
+			if (ACPI_FAILURE(status)) {
+				acpi_ps_free_op(arg);
+				return_ACPI_STATUS(status);
+			}
 		} else {
 			/* Single complex argument, nothing returned */

@@ -854,6 +858,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_sta=
te,
 			    acpi_ps_get_next_namepath(walk_state, parser_state,
 						      arg,
 						      ACPI_POSSIBLE_METHOD_CALL);
+			if (ACPI_FAILURE(status)) {
+				acpi_ps_free_op(arg);
+				return_ACPI_STATUS(status);
+			}

 			if (arg->common.aml_opcode =3D=3D AML_INT_METHODCALL_OP) {

=2D-
2.39.2