Merge tag 'acpi-fixes-3.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git...

Pull ACPICA fixes from Rafael Wysocki:

 - _INI regression fix from Tomasz Nowicki.

 - Fix for a possible memory leak in _OSI support routine from Jung-uk
   Kim.

 - Fix for a possible buffer overflow during field unit read operation
   from Bob Moore.

* tag 'acpi-fixes-3.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPICA: ACPICA: Fix for _INI regression
  ACPICA: _OSI support: Fix possible memory leak
  ACPICA: Fix possible buffer overflow during a field unit read operation

diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
index ec7f5690031b0c5c3c0e1b097f03943b3e07f510..c84ee956fa4c58f50c8849cc660a151d46febe39 100644 (file)
--- a/drivers/acpi/acpica/exfldio.c
+++ b/drivers/acpi/acpica/exfldio.c
@@ -720,7 +720,19 @@ acpi_ex_extract_from_field(union acpi_operand_object *obj_desc,
 
        if ((obj_desc->common_field.start_field_bit_offset == 0) &&
            (obj_desc->common_field.bit_length == access_bit_width)) {
-               status = acpi_ex_field_datum_io(obj_desc, 0, buffer, ACPI_READ);
+               if (buffer_length >= sizeof(u64)) {
+                       status =
+                           acpi_ex_field_datum_io(obj_desc, 0, buffer,
+                                                  ACPI_READ);
+               } else {
+                       /* Use raw_datum (u64) to handle buffers < 64 bits */
+
+                       status =
+                           acpi_ex_field_datum_io(obj_desc, 0, &raw_datum,
+                                                  ACPI_READ);
+                       ACPI_MEMCPY(buffer, &raw_datum, buffer_length);
+               }
+
                return_ACPI_STATUS(status);
        }
 

diff --git a/drivers/acpi/acpica/nsinit.c b/drivers/acpi/acpica/nsinit.c
index 2a431ec50a2543efa1383f573c83799b8f92c6a1..46f0f83417a1024613c39be6fe036996350107a7 100644 (file)
--- a/drivers/acpi/acpica/nsinit.c
+++ b/drivers/acpi/acpica/nsinit.c
@@ -558,6 +558,7 @@ acpi_ns_init_one_device(acpi_handle obj_handle,
        ACPI_DEBUG_EXEC(acpi_ut_display_init_pathname
                        (ACPI_TYPE_METHOD, device_node, METHOD_NAME__INI));
 
+       ACPI_MEMSET(info, 0, sizeof(struct acpi_evaluate_info));
        info->prefix_node = device_node;
        info->pathname = METHOD_NAME__INI;
        info->parameters = NULL;

diff --git a/drivers/acpi/acpica/utosi.c b/drivers/acpi/acpica/utosi.c
index b15acebb96a1590b9555942c53a6fe883e08b306..7e807725c636896aeeb83c3b35022eb2ad88848f 100644 (file)
--- a/drivers/acpi/acpica/utosi.c
+++ b/drivers/acpi/acpica/utosi.c
@@ -349,7 +349,8 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state * walk_state)
        return_value = 0;
        status = acpi_os_acquire_mutex(acpi_gbl_osi_mutex, ACPI_WAIT_FOREVER);
        if (ACPI_FAILURE(status)) {
-               return (status);
+               acpi_ut_remove_reference(return_desc);
+               return_ACPI_STATUS(status);
        }
 
        /* Lookup the interface in the global _OSI list */