ACPICA: Return error if DerefOf resolves to a null package element.

commit a50abf4842dd7d603a2ad6dcc7f1467fd2a66f03 upstream.

Disallow the dereference of a reference (via index) to an uninitialized
package element. Provides compatibility with other ACPI
implementations. ACPICA BZ 1003.

References: https://bugs.acpica.org/show_bug.cgi?id=431
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c
index eaa0fcd9644bf179ec41c3e4720e60ddf754b1ca..c3241b18843466c24d6f3e55447ca73f84091be6 100644 (file)
--- a/drivers/acpi/acpica/exoparg1.c
+++ b/drivers/acpi/acpica/exoparg1.c
@@ -963,10 +963,17 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
                                         */
                                        return_desc =
                                            *(operand[0]->reference.where);
-                                       if (return_desc) {
-                                               acpi_ut_add_reference
-                                                   (return_desc);
+                                       if (!return_desc) {
+                                               /*
+                                                * Element is NULL, do not allow the dereference.
+                                                * This provides compatibility with other ACPI
+                                                * implementations.
+                                                */
+                                               return_ACPI_STATUS
+                                                   (AE_AML_UNINITIALIZED_ELEMENT);
                                        }
+
+                                       acpi_ut_add_reference(return_desc);
                                        break;
 
                                default: