Merge tag 'acpi-fixes-3.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPICA fixes from Rafael Wysocki:

 - _INI regression fix from Tomasz Nowicki.

 - Fix for a possible memory leak in _OSI support routine from Jung-uk
   Kim.

 - Fix for a possible buffer overflow during field unit read operation
   from Bob Moore.

* tag 'acpi-fixes-3.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPICA: ACPICA: Fix for _INI regression
  ACPICA: _OSI support: Fix possible memory leak
  ACPICA: Fix possible buffer overflow during a field unit read operation

3 files changed, 16 insertions, 2 deletions

diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
index ec7f5690031b..c84ee956fa4c 100644
--- a/drivers/acpi/acpica/exfldio.c
+++ b/drivers/acpi/acpica/exfldio.c
@@ -720,7 +720,19 @@ acpi_ex_extract_from_field(union acpi_operand_object *obj_desc,
 
         if ((obj_desc->common_field.start_field_bit_offset == 0) &&
             (obj_desc->common_field.bit_length == access_bit_width)) {
-                status = acpi_ex_field_datum_io(obj_desc, 0, buffer, ACPI_READ);
+                if (buffer_length >= sizeof(u64)) {
+                        status =
+                            acpi_ex_field_datum_io(obj_desc, 0, buffer,
+                                                   ACPI_READ);
+                } else {
+                        /* Use raw_datum (u64) to handle buffers < 64 bits */
+
+                        status =
+                            acpi_ex_field_datum_io(obj_desc, 0, &raw_datum,
+                                                   ACPI_READ);
+                        ACPI_MEMCPY(buffer, &raw_datum, buffer_length);
+                }
+
                 return_ACPI_STATUS(status);
         }
 
diff --git a/drivers/acpi/acpica/nsinit.c b/drivers/acpi/acpica/nsinit.c
index 2a431ec50a25..46f0f83417a1 100644
--- a/drivers/acpi/acpica/nsinit.c
+++ b/drivers/acpi/acpica/nsinit.c
@@ -558,6 +558,7 @@ acpi_ns_init_one_device(acpi_handle obj_handle,
         ACPI_DEBUG_EXEC(acpi_ut_display_init_pathname
                         (ACPI_TYPE_METHOD, device_node, METHOD_NAME__INI));
 
+        ACPI_MEMSET(info, 0, sizeof(struct acpi_evaluate_info));
         info->prefix_node = device_node;
         info->pathname = METHOD_NAME__INI;
         info->parameters = NULL;
diff --git a/drivers/acpi/acpica/utosi.c b/drivers/acpi/acpica/utosi.c
index b15acebb96a1..7e807725c636 100644
--- a/drivers/acpi/acpica/utosi.c
+++ b/drivers/acpi/acpica/utosi.c
@@ -349,7 +349,8 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state * walk_state)
         return_value = 0;
         status = acpi_os_acquire_mutex(acpi_gbl_osi_mutex, ACPI_WAIT_FOREVER);
         if (ACPI_FAILURE(status)) {
-                return (status);
+                acpi_ut_remove_reference(return_desc);
+                return_ACPI_STATUS(status);
         }
 
         /* Lookup the interface in the global _OSI list */