ACPI: ACPICA 20060707

Added the ACPI_PACKED_POINTERS_NOT_SUPPORTED macro to
support C compilers that do not allow the initialization
of address pointers within packed structures - even though
the hardware itself may support misaligned transfers. Some
of the debug data structures are packed by default to
minimize size.

Added an error message for the case where
acpi_os_get_thread_id() returns zero. A non-zero value is
required by the core ACPICA code to ensure the proper
operation of AML mutexes and recursive control methods.

The DSDT is now the only ACPI table that determines whether
the AML interpreter is in 32-bit or 64-bit mode. Not really
a functional change, but the hooks for per-table 32/64
switching have been removed from the code. A clarification
to the ACPI specification is forthcoming in ACPI 3.0B.

Fixed a possible leak of an Owner ID in the error
path of tbinstal.c acpi_tb_init_table_descriptor() and
migrated all table OwnerID deletion to a single place in
acpi_tb_uninstall_table() to correct possible leaks when using
the acpi_tb_delete_tables_by_type() interface (with assistance
from Lance Ortiz.)

Fixed a problem with Serialized control methods where the
semaphore associated with the method could be over-signaled
after multiple method invocations.

Fixed two issues with the locking of the internal
namespace data structure. Both the Unload() operator and
acpi_unload_table() interface now lock the namespace during
the namespace deletion associated with the table unload
(with assistance from Linn Crosetto.)

Fixed problem reports (Valery Podrezov) integrated: -
Eliminate unnecessary memory allocation for CreateXxxxField
http://bugzilla.kernel.org/show_bug.cgi?id=5426

Fixed problem reports (Fiodor Suietov) integrated: -
Incomplete cleanup branches in AcpiTbGetTableRsdt (BZ 369)
- On Address Space handler deletion, needless deactivation
call (BZ 374) - AcpiRemoveAddressSpaceHandler: validate
Device handle parameter (BZ 375) - Possible memory leak,
Notify sub-objects of Processor, Power, ThermalZone (BZ
376) - AcpiRemoveAddressSpaceHandler: validate Handler
parameter (BZ 378) - Minimum Length of RSDT should be
validated (BZ 379) - AcpiRemoveNotifyHandler: return
AE_NOT_EXIST if Processor Obj has no Handler (BZ (380)
- AcpiUnloadTable: return AE_NOT_EXIST if no table of
specified type loaded (BZ 381)

Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>

1 files changed, 23 insertions, 4 deletions

diff --git a/drivers/acpi/tables/tbrsdt.c b/drivers/acpi/tables/tbrsdt.c
index abcb08c2592a..0ad3dbb9ebca 100644
--- a/drivers/acpi/tables/tbrsdt.c
+++ b/drivers/acpi/tables/tbrsdt.c
@@ -183,6 +183,17 @@ acpi_status acpi_tb_validate_rsdt(struct acpi_table_header *table_ptr)
 
         ACPI_FUNCTION_ENTRY();
 
+        /* Validate minimum length */
+
+        if (table_ptr->length < sizeof(struct acpi_table_header)) {
+                ACPI_ERROR((AE_INFO,
+                            "RSDT/XSDT length (%X) is smaller than minimum (%X)",
+                            table_ptr->length,
+                            sizeof(struct acpi_table_header)));
+
+                return (AE_INVALID_TABLE_LENGTH);
+        }
+
         /* Search for appropriate signature, RSDT or XSDT */
 
         if (acpi_gbl_root_table_type == ACPI_TABLE_TYPE_RSDT) {
@@ -210,7 +221,7 @@ acpi_status acpi_tb_validate_rsdt(struct acpi_table_header *table_ptr)
                         ACPI_ERROR((AE_INFO, "Looking for XSDT"));
                 }
 
-                ACPI_DUMP_BUFFER((char *)table_ptr, 48);
+                ACPI_DUMP_BUFFER(ACPI_CAST_PTR(char, table_ptr), 48);
                 return (AE_BAD_SIGNATURE);
         }
 
@@ -258,7 +269,7 @@ acpi_status acpi_tb_get_table_rsdt(void)
 
         status = acpi_tb_validate_rsdt(table_info.pointer);
         if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+                goto error_cleanup;
         }
 
         /* Get the number of tables defined in the RSDT or XSDT */
@@ -270,14 +281,14 @@ acpi_status acpi_tb_get_table_rsdt(void)
 
         status = acpi_tb_convert_to_xsdt(&table_info);
         if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+                goto error_cleanup;
         }
 
         /* Save the table pointers and allocation info */
 
         status = acpi_tb_init_table_descriptor(ACPI_TABLE_ID_XSDT, &table_info);
         if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+                goto error_cleanup;
         }
 
         acpi_gbl_XSDT =
@@ -285,4 +296,12 @@ acpi_status acpi_tb_get_table_rsdt(void)
 
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "XSDT located at %p\n", acpi_gbl_XSDT));
         return_ACPI_STATUS(status);
+
+      error_cleanup:
+
+        /* Free table allocated by acpi_tb_get_table */
+
+        acpi_tb_delete_single_table(&table_info);
+
+        return_ACPI_STATUS(status);
 }