Merge branch 'acpi-pm'

* acpi-pm:
  ACPI / PM: Fix possible NULL pointer deref in acpi_pm_device_sleep_state()

1 files changed, 8 insertions, 4 deletions

diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 67624d4d5aef..e9e8bb24785b 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -541,7 +541,7 @@ int acpi_pm_device_sleep_state(struct device *dev, int *d_min_p, int d_max_in)
 {
         acpi_handle handle = DEVICE_ACPI_HANDLE(dev);
         struct acpi_device *adev;
-        int ret, d_max;
+        int ret, d_min, d_max;
 
         if (d_max_in < ACPI_STATE_D0 || d_max_in > ACPI_STATE_D3_COLD)
                 return -EINVAL;
@@ -560,19 +560,23 @@ int acpi_pm_device_sleep_state(struct device *dev, int *d_min_p, int d_max_in)
         }
 
         ret = acpi_dev_pm_get_state(dev, adev, acpi_target_system_state(),
-                                    d_min_p, &d_max);
+                                    &d_min, &d_max);
         if (ret)
                 return ret;
 
-        if (d_max_in < *d_min_p)
+        if (d_max_in < d_min)
                 return -EINVAL;
 
         if (d_max > d_max_in) {
-                for (d_max = d_max_in; d_max > *d_min_p; d_max--) {
+                for (d_max = d_max_in; d_max > d_min; d_max--) {
                         if (adev->power.states[d_max].flags.valid)
                                 break;
                 }
         }
+
+        if (d_min_p)
+                *d_min_p = d_min;
+
         return d_max;
 }
 EXPORT_SYMBOL(acpi_pm_device_sleep_state);