ACPICA 20050526 from Bob Moore <robert.moore@intel.com>

Implemented support to execute Type 1 and Type 2 AML
opcodes appearing at the module level (not within a control
method.)  These opcodes are executed exactly once at the
time the table is loaded. This type of code was legal up
until the release of ACPI 2.0B (2002) and is now supported
within ACPI CA in order to provide backwards compatibility
with earlier BIOS implementations. This eliminates the
"Encountered executable code at module level" warning that
was previously generated upon detection of such code.

Fixed a problem in the interpreter where an AE_NOT_FOUND
exception could inadvertently be generated during the
lookup of namespace objects in the second pass parse of
ACPI tables and control methods. It appears that this
problem could occur during the resolution of forward
references to namespace objects.

Added the ACPI_MUTEX_DEBUG #ifdef to the
acpi_ut_release_mutex function, corresponding to the same
the deadlock detection debug code to be compiled out in
the normal case, improving mutex performance (and overall
subsystem performance) considerably.  As suggested by
Alexey Starikovskiy.

Implemented a handful of miscellaneous fixes for possible
memory leaks on error conditions and error handling
control paths. These fixes were suggested by FreeBSD and
the Coverity Prevent source code analysis tool.

Added a check for a null RSDT pointer in
acpi_get_firmware_table (tbxfroot.c) to prevent a fault
in this error case.

Signed-off-by Len Brown <len.brown@intel.com>

4 files changed, 33 insertions, 17 deletions

diff --git a/drivers/acpi/executer/exconfig.c b/drivers/acpi/executer/exconfig.c
index 734b2f24af48..8bfa6effaa0c 100644
--- a/drivers/acpi/executer/exconfig.c
+++ b/drivers/acpi/executer/exconfig.c
@@ -376,16 +376,22 @@ acpi_ex_load_op (
 		 */
 		status = acpi_ex_read_data_from_field (walk_state, obj_desc, &buffer_desc);
 		if (ACPI_FAILURE (status)) {
-			goto cleanup;
+			return_ACPI_STATUS (status);
 		}
 
 		table_ptr = ACPI_CAST_PTR (struct acpi_table_header,
 				  buffer_desc->buffer.pointer);
 
-		 /* Sanity check the table length */
+		/* All done with the buffer_desc, delete it */
+
+		buffer_desc->buffer.pointer = NULL;
+		acpi_ut_remove_reference (buffer_desc);
+
+		/* Sanity check the table length */
 
 		if (table_ptr->length < sizeof (struct acpi_table_header)) {
-			return_ACPI_STATUS (AE_BAD_HEADER);
+			status = AE_BAD_HEADER;
+			goto cleanup;
 		}
 		break;
 
@@ -413,7 +419,9 @@ acpi_ex_load_op (
 
 	status = acpi_ex_add_table (table_ptr, acpi_gbl_root_node, &ddb_handle);
 	if (ACPI_FAILURE (status)) {
-		goto cleanup;
+		/* On error, table_ptr was deallocated above */
+
+		return_ACPI_STATUS (status);
 	}
 
 	/* Store the ddb_handle into the Target operand */
@@ -421,17 +429,14 @@ acpi_ex_load_op (
 	status = acpi_ex_store (ddb_handle, target, walk_state);
 	if (ACPI_FAILURE (status)) {
 		(void) acpi_ex_unload_table (ddb_handle);
-	}
 
-	return_ACPI_STATUS (status);
+		/* table_ptr was deallocated above */
 
+		return_ACPI_STATUS (status);
+	}
 
 cleanup:
-
-	if (buffer_desc) {
-		acpi_ut_remove_reference (buffer_desc);
-	}
-	else {
+	if (ACPI_FAILURE (status)) {
 		ACPI_MEM_FREE (table_ptr);
 	}
 	return_ACPI_STATUS (status);
diff --git a/drivers/acpi/executer/exfield.c b/drivers/acpi/executer/exfield.c
index 22c8fa480f60..a690c9250990 100644
--- a/drivers/acpi/executer/exfield.c
+++ b/drivers/acpi/executer/exfield.c
@@ -87,6 +87,9 @@ acpi_ex_read_data_from_field (
 	if (!obj_desc) {
 		return_ACPI_STATUS (AE_AML_NO_OPERAND);
 	}
+	if (!ret_buffer_desc) {
+		return_ACPI_STATUS (AE_BAD_PARAMETER);
+	}
 
 	if (ACPI_GET_OBJECT_TYPE (obj_desc) == ACPI_TYPE_BUFFER_FIELD) {
 		/*
@@ -182,7 +185,7 @@ exit:
 	if (ACPI_FAILURE (status)) {
 		acpi_ut_remove_reference (buffer_desc);
 	}
-	else if (ret_buffer_desc) {
+	else {
 		*ret_buffer_desc = buffer_desc;
 	}
 
diff --git a/drivers/acpi/executer/exnames.c b/drivers/acpi/executer/exnames.c
index 639f0bd3f6d8..b6ba1a7a677a 100644
--- a/drivers/acpi/executer/exnames.c
+++ b/drivers/acpi/executer/exnames.c
@@ -438,6 +438,13 @@ acpi_ex_get_name_string (
 		status = AE_AML_BAD_NAME;
 	}
 
+	if (ACPI_FAILURE (status)) {
+		if (name_string) {
+			ACPI_MEM_FREE (name_string);
+		}
+		return_ACPI_STATUS (status);
+	}
+
 	*out_name_string = name_string;
 	*out_name_length = (u32) (aml_address - in_aml_address);
 
diff --git a/drivers/acpi/executer/exoparg1.c b/drivers/acpi/executer/exoparg1.c
index dbdf8262ba00..ffc61ddeb659 100644
--- a/drivers/acpi/executer/exoparg1.c
+++ b/drivers/acpi/executer/exoparg1.c
@@ -127,15 +127,16 @@ acpi_ex_opcode_0A_0T_1R (
 
 cleanup:
 
-	if (!walk_state->result_obj) {
-		walk_state->result_obj = return_desc;
-	}
-
 	/* Delete return object on error */
 
-	if (ACPI_FAILURE (status)) {
+	if ((ACPI_FAILURE (status)) || walk_state->result_obj) {
 		acpi_ut_remove_reference (return_desc);
 	}
+	else {
+		/* Save the return value */
+
+		walk_state->result_obj = return_desc;
+	}
 
 	return_ACPI_STATUS (status);
 }