1 files changed, 49 insertions, 28 deletions

diff --git a/drivers/acpi/executer/exoparg2.c b/drivers/acpi/executer/exoparg2.c
index e263a5ddd405..5e1abb12c748 100644
--- a/drivers/acpi/executer/exoparg2.c
+++ b/drivers/acpi/executer/exoparg2.c
@@ -138,6 +138,7 @@ acpi_status acpi_ex_opcode_2A_0T_0R(struct acpi_walk_state *walk_state)
                             acpi_ev_check_for_wake_only_gpe(walk_state->
                                                             gpe_event_info);
                         if (ACPI_FAILURE(status)) {
+
                                 /* AE_WAKE_ONLY_GPE only error, means ignore this notify */
 
                                 return_ACPI_STATUS(AE_OK)
@@ -252,6 +253,7 @@ acpi_status acpi_ex_opcode_2A_2T_1R(struct acpi_walk_state *walk_state)
         acpi_ut_remove_reference(return_desc2);
 
         if (ACPI_FAILURE(status)) {
+
                 /* Delete the return object */
 
                 acpi_ut_remove_reference(return_desc1);
@@ -287,6 +289,7 @@ acpi_status acpi_ex_opcode_2A_1T_1R(struct acpi_walk_state *walk_state)
         /* Execute the opcode */
 
         if (walk_state->op_info->flags & AML_MATH) {
+
                 /* All simple math opcodes (add, etc.) */
 
                 return_desc = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
@@ -383,54 +386,70 @@ acpi_status acpi_ex_opcode_2A_1T_1R(struct acpi_walk_state *walk_state)
                         goto cleanup;
                 }
 
+                /* Initialize the Index reference object */
+
                 index = operand[1]->integer.value;
+                return_desc->reference.offset = (u32) index;
+                return_desc->reference.opcode = AML_INDEX_OP;
+                return_desc->reference.object = operand[0];
 
-                /* At this point, the Source operand is a Package, Buffer, or String */
+                /*
+                 * At this point, the Source operand is a String, Buffer, or Package.
+                 * Verify that the index is within range.
+                 */
+                switch (ACPI_GET_OBJECT_TYPE(operand[0])) {
+                case ACPI_TYPE_STRING:
 
-                if (ACPI_GET_OBJECT_TYPE(operand[0]) == ACPI_TYPE_PACKAGE) {
-                        /* Object to be indexed is a Package */
+                        if (index >= operand[0]->string.length) {
+                                status = AE_AML_STRING_LIMIT;
+                        }
+
+                        return_desc->reference.target_type =
+                            ACPI_TYPE_BUFFER_FIELD;
+                        break;
+
+                case ACPI_TYPE_BUFFER:
+
+                        if (index >= operand[0]->buffer.length) {
+                                status = AE_AML_BUFFER_LIMIT;
+                        }
+
+                        return_desc->reference.target_type =
+                            ACPI_TYPE_BUFFER_FIELD;
+                        break;
+
+                case ACPI_TYPE_PACKAGE:
 
                         if (index >= operand[0]->package.count) {
-                                ACPI_ERROR((AE_INFO,
-                                            "Index value (%X%8.8X) beyond package end (%X)",
-                                            ACPI_FORMAT_UINT64(index),
-                                            operand[0]->package.count));
                                 status = AE_AML_PACKAGE_LIMIT;
-                                goto cleanup;
                         }
 
                         return_desc->reference.target_type = ACPI_TYPE_PACKAGE;
-                        return_desc->reference.object = operand[0];
                         return_desc->reference.where =
                             &operand[0]->package.elements[index];
-                } else {
-                        /* Object to be indexed is a Buffer/String */
+                        break;
 
-                        if (index >= operand[0]->buffer.length) {
-                                ACPI_ERROR((AE_INFO,
-                                            "Index value (%X%8.8X) beyond end of buffer (%X)",
-                                            ACPI_FORMAT_UINT64(index),
-                                            operand[0]->buffer.length));
-                                status = AE_AML_BUFFER_LIMIT;
-                                goto cleanup;
-                        }
+                default:
 
-                        return_desc->reference.target_type =
-                            ACPI_TYPE_BUFFER_FIELD;
-                        return_desc->reference.object = operand[0];
+                        status = AE_AML_INTERNAL;
+                        goto cleanup;
+                }
+
+                /* Failure means that the Index was beyond the end of the object */
+
+                if (ACPI_FAILURE(status)) {
+                        ACPI_EXCEPTION((AE_INFO, status,
+                                        "Index (%X%8.8X) is beyond end of object",
+                                        ACPI_FORMAT_UINT64(index)));
+                        goto cleanup;
                 }
 
                 /*
                  * Add a reference to the target package/buffer/string for the life
-                 * of the index.
+                 * of the index
                  */
                 acpi_ut_add_reference(operand[0]);
 
-                /* Complete the Index reference object */
-
-                return_desc->reference.opcode = AML_INDEX_OP;
-                return_desc->reference.offset = (u32) index;
-
                 /* Store the reference to the Target */
 
                 status = acpi_ex_store(return_desc, operand[2], walk_state);
@@ -509,6 +528,7 @@ acpi_status acpi_ex_opcode_2A_0T_1R(struct acpi_walk_state *walk_state)
         /* Execute the Opcode */
 
         if (walk_state->op_info->flags & AML_LOGICAL_NUMERIC) {
+
                 /* logical_op (Operand0, Operand1) */
 
                 status = acpi_ex_do_logical_numeric_op(walk_state->opcode,
@@ -518,6 +538,7 @@ acpi_status acpi_ex_opcode_2A_0T_1R(struct acpi_walk_state *walk_state)
                                                        value, &logical_result);
                 goto store_logical_result;
         } else if (walk_state->op_info->flags & AML_LOGICAL) {
+
                 /* logical_op (Operand0, Operand1) */
 
                 status = acpi_ex_do_logical_op(walk_state->opcode, operand[0],