diff options
author | Lin Ming <ming.m.lin@intel.com> | 2009-10-12 22:23:20 -0400 |
---|---|---|
committer | Len Brown <len.brown@intel.com> | 2009-11-24 20:30:03 -0500 |
commit | 0240d7b4f20f7d156a74dfdd0647a0231b7e8ef4 (patch) | |
tree | 135f87ba510a800c751e31c65d60f590197a201c | |
parent | 2752699392b828edf3123f911f6e8b4dd7daeb56 (diff) |
ACPICA: Add repair for bad _MAT buffers
_MAT can inadvertently return an Integer instead of a Buffer
if the return value has been read from a Field whose width is
less than or equal to the global integer width (32 or 64 bits).
ACPICA BZ 810.
http://www.acpica.org/bugzilla/show_bug.cgi?id=810
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
-rw-r--r-- | drivers/acpi/acpica/nsrepair.c | 23 |
1 files changed, 21 insertions, 2 deletions
diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c index dfa31c5ba6c3..f2f5269fed6d 100644 --- a/drivers/acpi/acpica/nsrepair.c +++ b/drivers/acpi/acpica/nsrepair.c | |||
@@ -44,6 +44,7 @@ | |||
44 | #include <acpi/acpi.h> | 44 | #include <acpi/acpi.h> |
45 | #include "accommon.h" | 45 | #include "accommon.h" |
46 | #include "acnamesp.h" | 46 | #include "acnamesp.h" |
47 | #include "acinterp.h" | ||
47 | #include "acpredef.h" | 48 | #include "acpredef.h" |
48 | 49 | ||
49 | #define _COMPONENT ACPI_NAMESPACE | 50 | #define _COMPONENT ACPI_NAMESPACE |
@@ -76,6 +77,7 @@ acpi_ns_repair_object(struct acpi_predefined_data *data, | |||
76 | union acpi_operand_object *return_object = *return_object_ptr; | 77 | union acpi_operand_object *return_object = *return_object_ptr; |
77 | union acpi_operand_object *new_object; | 78 | union acpi_operand_object *new_object; |
78 | acpi_size length; | 79 | acpi_size length; |
80 | acpi_status status; | ||
79 | 81 | ||
80 | /* | 82 | /* |
81 | * At this point, we know that the type of the returned object was not | 83 | * At this point, we know that the type of the returned object was not |
@@ -120,9 +122,26 @@ acpi_ns_repair_object(struct acpi_predefined_data *data, | |||
120 | 122 | ||
121 | case ACPI_TYPE_INTEGER: | 123 | case ACPI_TYPE_INTEGER: |
122 | 124 | ||
123 | /* Does the method/object legally return a string? */ | 125 | /* 1) Does the method/object legally return a buffer? */ |
126 | |||
127 | if (expected_btypes & ACPI_RTYPE_BUFFER) { | ||
128 | /* | ||
129 | * Convert the Integer to a packed-byte buffer. _MAT needs | ||
130 | * this sometimes, if a read has been performed on a Field | ||
131 | * object that is less than or equal to the global integer | ||
132 | * size (32 or 64 bits). | ||
133 | */ | ||
134 | status = | ||
135 | acpi_ex_convert_to_buffer(return_object, | ||
136 | &new_object); | ||
137 | if (ACPI_FAILURE(status)) { | ||
138 | return (status); | ||
139 | } | ||
140 | } | ||
141 | |||
142 | /* 2) Does the method/object legally return a string? */ | ||
124 | 143 | ||
125 | if (expected_btypes & ACPI_RTYPE_STRING) { | 144 | else if (expected_btypes & ACPI_RTYPE_STRING) { |
126 | /* | 145 | /* |
127 | * The only supported Integer-to-String conversion is to convert | 146 | * The only supported Integer-to-String conversion is to convert |
128 | * an integer of value 0 to a NULL string. The last element of | 147 | * an integer of value 0 to a NULL string. The last element of |