ACPICA: Return error if DerefOf resolves to a null package element.

commit a50abf4842dd7d603a2ad6dcc7f1467fd2a66f03 upstream.

Disallow the dereference of a reference (via index) to an uninitialized
package element. Provides compatibility with other ACPI
implementations. ACPICA BZ 1003.

References: https://bugs.acpica.org/show_bug.cgi?id=431
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 10 insertions, 3 deletions

diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c
index eaa0fcd9644b..c3241b188434 100644
--- a/drivers/acpi/acpica/exoparg1.c
+++ b/drivers/acpi/acpica/exoparg1.c
@@ -963,10 +963,17 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
                                          */
                                         return_desc =
                                             *(operand[0]->reference.where);
-                                        if (return_desc) {
-                                                acpi_ut_add_reference
-                                                    (return_desc);
+                                        if (!return_desc) {
+                                                /*
+                                                 * Element is NULL, do not allow the dereference.
+                                                 * This provides compatibility with other ACPI
+                                                 * implementations.
+                                                 */
+                                                return_ACPI_STATUS
+                                                    (AE_AML_UNINITIALIZED_ELEMENT);
                                         }
+
+                                        acpi_ut_add_reference(return_desc);
                                         break;
 
                                 default: