4 files changed, 33 insertions, 17 deletions

diff --git a/drivers/acpi/executer/exconfig.c b/drivers/acpi/executer/exconfig.c
index 734b2f24af48..8bfa6effaa0c 100644
--- a/drivers/acpi/executer/exconfig.c
+++ b/drivers/acpi/executer/exconfig.c
@@ -376,16 +376,22 @@ acpi_ex_load_op (
                  */
                 status = acpi_ex_read_data_from_field (walk_state, obj_desc, &buffer_desc);
                 if (ACPI_FAILURE (status)) {
-                        goto cleanup;
+                        return_ACPI_STATUS (status);
                 }
 
                 table_ptr = ACPI_CAST_PTR (struct acpi_table_header,
                                   buffer_desc->buffer.pointer);
 
-                 /* Sanity check the table length */
+                /* All done with the buffer_desc, delete it */
+
+                buffer_desc->buffer.pointer = NULL;
+                acpi_ut_remove_reference (buffer_desc);
+
+                /* Sanity check the table length */
 
                 if (table_ptr->length < sizeof (struct acpi_table_header)) {
-                        return_ACPI_STATUS (AE_BAD_HEADER);
+                        status = AE_BAD_HEADER;
+                        goto cleanup;
                 }
                 break;
 
@@ -413,7 +419,9 @@ acpi_ex_load_op (
 
         status = acpi_ex_add_table (table_ptr, acpi_gbl_root_node, &ddb_handle);
         if (ACPI_FAILURE (status)) {
-                goto cleanup;
+                /* On error, table_ptr was deallocated above */
+
+                return_ACPI_STATUS (status);
         }
 
         /* Store the ddb_handle into the Target operand */
@@ -421,17 +429,14 @@ acpi_ex_load_op (
         status = acpi_ex_store (ddb_handle, target, walk_state);
         if (ACPI_FAILURE (status)) {
                 (void) acpi_ex_unload_table (ddb_handle);
-        }
 
-        return_ACPI_STATUS (status);
+                /* table_ptr was deallocated above */
 
+                return_ACPI_STATUS (status);
+        }
 
 cleanup:
-
-        if (buffer_desc) {
-                acpi_ut_remove_reference (buffer_desc);
-        }
-        else {
+        if (ACPI_FAILURE (status)) {
                 ACPI_MEM_FREE (table_ptr);
         }
         return_ACPI_STATUS (status);
diff --git a/drivers/acpi/executer/exfield.c b/drivers/acpi/executer/exfield.c
index 22c8fa480f60..a690c9250990 100644
--- a/drivers/acpi/executer/exfield.c
+++ b/drivers/acpi/executer/exfield.c
@@ -87,6 +87,9 @@ acpi_ex_read_data_from_field (
         if (!obj_desc) {
                 return_ACPI_STATUS (AE_AML_NO_OPERAND);
         }
+        if (!ret_buffer_desc) {
+                return_ACPI_STATUS (AE_BAD_PARAMETER);
+        }
 
         if (ACPI_GET_OBJECT_TYPE (obj_desc) == ACPI_TYPE_BUFFER_FIELD) {
                 /*
@@ -182,7 +185,7 @@ exit:
         if (ACPI_FAILURE (status)) {
                 acpi_ut_remove_reference (buffer_desc);
         }
-        else if (ret_buffer_desc) {
+        else {
                 *ret_buffer_desc = buffer_desc;
         }
 
diff --git a/drivers/acpi/executer/exnames.c b/drivers/acpi/executer/exnames.c
index 639f0bd3f6d8..b6ba1a7a677a 100644
--- a/drivers/acpi/executer/exnames.c
+++ b/drivers/acpi/executer/exnames.c
@@ -438,6 +438,13 @@ acpi_ex_get_name_string (
                 status = AE_AML_BAD_NAME;
         }
 
+        if (ACPI_FAILURE (status)) {
+                if (name_string) {
+                        ACPI_MEM_FREE (name_string);
+                }
+                return_ACPI_STATUS (status);
+        }
+
         *out_name_string = name_string;
         *out_name_length = (u32) (aml_address - in_aml_address);
 
diff --git a/drivers/acpi/executer/exoparg1.c b/drivers/acpi/executer/exoparg1.c
index dbdf8262ba00..ffc61ddeb659 100644
--- a/drivers/acpi/executer/exoparg1.c
+++ b/drivers/acpi/executer/exoparg1.c
@@ -127,15 +127,16 @@ acpi_ex_opcode_0A_0T_1R (
 
 cleanup:
 
-        if (!walk_state->result_obj) {
-                walk_state->result_obj = return_desc;
-        }
-
         /* Delete return object on error */
 
-        if (ACPI_FAILURE (status)) {
+        if ((ACPI_FAILURE (status)) || walk_state->result_obj) {
                 acpi_ut_remove_reference (return_desc);
         }
+        else {
+                /* Save the return value */
+
+                walk_state->result_obj = return_desc;
+        }
 
         return_ACPI_STATUS (status);
 }