commit 3362a6badb4fe75e198885b125b21ccf846861b4
author Lin Ming <ming.m.lin@intel.com> Thu May 21 11:03:29 2009 +0800
committer Len Brown <len.brown@intel.com> Wed May 27 00:35:51 2009 -0400
tree 2341f6b7bebd82b6c097c58a23c22c3839d9701b
parent c446eed6187addf9f76ee0028abed32393aef27e

ACPICA: Region deletion: Ensure region object is removed from handler list

Prevents a possible fault when a dynamic operation region is
deleted. ACPICA BZ 507.

http://acpica.org/bugzilla/show_bug.cgi?id=507

Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>

drivers/acpi/acpica/utdelete.c

diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c
index a5ee23b..bc17103 100644
--- a/drivers/acpi/acpica/utdelete.c
+++ b/drivers/acpi/acpica/utdelete.c
@@ -75,6 +75,7 @@
 	union acpi_operand_object *handler_desc;
 	union acpi_operand_object *second_desc;
 	union acpi_operand_object *next_desc;
+	union acpi_operand_object **last_obj_ptr;
 
 	ACPI_FUNCTION_TRACE_PTR(ut_delete_internal_obj, object);
 
@@ -223,6 +224,26 @@
 			 */
 			handler_desc = object->region.handler;
 			if (handler_desc) {
+				next_desc =
+				    handler_desc->address_space.region_list;
+				last_obj_ptr =
+				    &handler_desc->address_space.region_list;
+
+				/* Remove the region object from the handler's list */
+
+				while (next_desc) {
+					if (next_desc == object) {
+						*last_obj_ptr =
+						    next_desc->region.next;
+						break;
+					}
+
+					/* Walk the linked list of handler */
+
+					last_obj_ptr = &next_desc->region.next;
+					next_desc = next_desc->region.next;
+				}
+
 				if (handler_desc->address_space.handler_flags &
 				    ACPI_ADDR_HANDLER_DEFAULT_INSTALLED) {