diff options
Diffstat (limited to 'drivers/acpi/acpica/utdelete.c')
-rw-r--r-- | drivers/acpi/acpica/utdelete.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c index ed4cb8683310..a3516de213fa 100644 --- a/drivers/acpi/acpica/utdelete.c +++ b/drivers/acpi/acpica/utdelete.c | |||
@@ -75,6 +75,7 @@ static void acpi_ut_delete_internal_obj(union acpi_operand_object *object) | |||
75 | union acpi_operand_object *handler_desc; | 75 | union acpi_operand_object *handler_desc; |
76 | union acpi_operand_object *second_desc; | 76 | union acpi_operand_object *second_desc; |
77 | union acpi_operand_object *next_desc; | 77 | union acpi_operand_object *next_desc; |
78 | union acpi_operand_object *start_desc; | ||
78 | union acpi_operand_object **last_obj_ptr; | 79 | union acpi_operand_object **last_obj_ptr; |
79 | 80 | ||
80 | ACPI_FUNCTION_TRACE_PTR(ut_delete_internal_obj, object); | 81 | ACPI_FUNCTION_TRACE_PTR(ut_delete_internal_obj, object); |
@@ -235,10 +236,11 @@ static void acpi_ut_delete_internal_obj(union acpi_operand_object *object) | |||
235 | if (handler_desc) { | 236 | if (handler_desc) { |
236 | next_desc = | 237 | next_desc = |
237 | handler_desc->address_space.region_list; | 238 | handler_desc->address_space.region_list; |
239 | start_desc = next_desc; | ||
238 | last_obj_ptr = | 240 | last_obj_ptr = |
239 | &handler_desc->address_space.region_list; | 241 | &handler_desc->address_space.region_list; |
240 | 242 | ||
241 | /* Remove the region object from the handler's list */ | 243 | /* Remove the region object from the handler list */ |
242 | 244 | ||
243 | while (next_desc) { | 245 | while (next_desc) { |
244 | if (next_desc == object) { | 246 | if (next_desc == object) { |
@@ -247,10 +249,19 @@ static void acpi_ut_delete_internal_obj(union acpi_operand_object *object) | |||
247 | break; | 249 | break; |
248 | } | 250 | } |
249 | 251 | ||
250 | /* Walk the linked list of handler */ | 252 | /* Walk the linked list of handlers */ |
251 | 253 | ||
252 | last_obj_ptr = &next_desc->region.next; | 254 | last_obj_ptr = &next_desc->region.next; |
253 | next_desc = next_desc->region.next; | 255 | next_desc = next_desc->region.next; |
256 | |||
257 | /* Prevent infinite loop if list is corrupted */ | ||
258 | |||
259 | if (next_desc == start_desc) { | ||
260 | ACPI_ERROR((AE_INFO, | ||
261 | "Circular region list in address handler object %p", | ||
262 | handler_desc)); | ||
263 | return_VOID; | ||
264 | } | ||
254 | } | 265 | } |
255 | 266 | ||
256 | if (handler_desc->address_space.handler_flags & | 267 | if (handler_desc->address_space.handler_flags & |