ACPICA: nsrepair: handle cases without a return value correctly (573dfeba) · Commits · e / devices / android_kernel_fairphone_FP5

[ Upstream commit ca843a4c79486e99a19b859ef0b9887854afe146 ] Previously acpi_ns_simple_repair() would crash if expected_btypes contained any combination of ACPI_RTYPE_NONE with a different type, e.g | ACPI_RTYPE_INTEGER because of slightly incorrect logic in the !return_object branch, which wouldn't return AE_AML_NO_RETURN_VALUE for such cases. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Link: https://github.com/acpica/acpica/pull/811 Fixes: ("ACPICA: Restore code that repairs NULL package elements in return values.") Signed-off-by:

Daniil Tatianin <d-tatianin@yandex-team.ru> Signed-off-by:

Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by:

Sasha Levin <sashal@kernel.org>

drivers/acpi/acpica/nsrepair.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -181,8 +181,9 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,
		* Try to fix if there was no return object. Warning if failed to fix.
		*/
		if (!return_object) {
		if (expected_btypes && (!(expected_btypes & ACPI_RTYPE_NONE))) {
		if (package_index != ACPI_NOT_PACKAGE_ELEMENT) {
		if (expected_btypes) {
		if (!(expected_btypes & ACPI_RTYPE_NONE) &&
		package_index != ACPI_NOT_PACKAGE_ELEMENT) {
		ACPI_WARN_PREDEFINED((AE_INFO,
		info->full_pathname,
		ACPI_WARN_ALWAYS,
		@@ -196,16 +197,17 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,
		if (ACPI_SUCCESS(status)) {
		return (AE_OK); /* Repair was successful */
		}
		} else {
		}

		if (expected_btypes != ACPI_RTYPE_NONE) {
		ACPI_WARN_PREDEFINED((AE_INFO,
		info->full_pathname,
		ACPI_WARN_ALWAYS,
		"Missing expected return value"));
		}

		return (AE_AML_NO_RETURN_VALUE);
		}
		}
		}

		if (expected_btypes & ACPI_RTYPE_INTEGER) {
		status = acpi_ns_convert_to_integer(return_object, &new_object);