CVE-2022-50411

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Fix error code path in acpidscallcontrolmethod()

A use-after-free in acpipsparseaml() after a failing invocaion of acpidscallcontrolmethod() is reported by KASAN [1] and code inspection reveals that nextwalkstate pushed to the thread by acpidscreatewalkstate() is freed on errors, but it is not popped from the thread beforehand. Thus acpidsgetcurrentwalkstate() called by acpipsparse_aml() subsequently returns it as the new walk state which is incorrect.

To address this, make acpidscallcontrolmethod() call acpidspopwalkstate() to pop nextwalkstate from the thread before returning an error.