Commit ab317b32 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'acpi-6.9-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm 

Pull ACPI fixes from Rafael Wysocki:
 "These fix two issues that may lead to attempts to use memory that has
  been freed already.

  Specifics:

   - Drop __exit annotation from einj_remove() in the ACPI APEI code
     because this function can be called during runtime (Arnd Bergmann)

   - Make acpi_db_walk_for_fields() check acpi_evaluate_object() return
     value to avoid accessing memory that has been freed (Nikita
     Kiryushin)"

* tag 'acpi-6.9-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields()
  ACPI: APEI: EINJ: mark remove callback as non-__exit
parents 1096bc93 6af71633

drivers/acpi/acpica/dbnames.c

+6 −2
Original line number Diff line number Diff line
@@ -550,8 +550,12 @@ acpi_db_walk_for_fields(acpi_handle obj_handle, 
	ACPI_FREE(buffer.pointer);



	buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER;

	acpi_evaluate_object(obj_handle, NULL, NULL, &buffer);



	status = acpi_evaluate_object(obj_handle, NULL, NULL, &buffer);

	if (ACPI_FAILURE(status)) {

		acpi_os_printf("Could Not evaluate object %p\n",

			       obj_handle);

		return (AE_OK);

	}

	/*

	 * Since this is a field unit, surround the output in braces

	 */

drivers/acpi/apei/einj-core.c

+1 −1
Original line number Diff line number Diff line
@@ -851,7 +851,7 @@ static int __init einj_probe(struct platform_device *pdev) 
	return rc;

}



static void __exit einj_remove(struct platform_device *pdev)

static void einj_remove(struct platform_device *pdev)

{

	struct apei_exec_context ctx;