Loading drivers/acpi/bus.c +18 −8 Original line number Diff line number Diff line Loading @@ -397,6 +397,7 @@ acpi_status acpi_run_osc(acpi_handle handle, struct acpi_osc_context *context) union acpi_object *out_obj; u8 uuid[16]; u32 errors; struct acpi_buffer output = {ACPI_ALLOCATE_BUFFER, NULL}; if (!context) return AE_ERROR; Loading @@ -419,16 +420,16 @@ acpi_status acpi_run_osc(acpi_handle handle, struct acpi_osc_context *context) in_params[3].buffer.length = context->cap.length; in_params[3].buffer.pointer = context->cap.pointer; status = acpi_evaluate_object(handle, "_OSC", &input, &context->ret); status = acpi_evaluate_object(handle, "_OSC", &input, &output); if (ACPI_FAILURE(status)) return status; /* return buffer should have the same length as cap buffer */ if (context->ret.length != context->cap.length) if (!output.length) return AE_NULL_OBJECT; out_obj = context->ret.pointer; if (out_obj->type != ACPI_TYPE_BUFFER) { out_obj = output.pointer; if (out_obj->type != ACPI_TYPE_BUFFER || out_obj->buffer.length != context->cap.length) { acpi_print_osc_error(handle, context, "_OSC evaluation returned wrong type"); status = AE_TYPE; Loading Loading @@ -457,10 +458,19 @@ acpi_status acpi_run_osc(acpi_handle handle, struct acpi_osc_context *context) goto out_kfree; } out_success: return AE_OK; context->ret.length = out_obj->buffer.length; context->ret.pointer = kmalloc(context->ret.length, GFP_KERNEL); if (!context->ret.pointer) { status = AE_NO_MEMORY; goto out_kfree; } memcpy(context->ret.pointer, out_obj->buffer.pointer, context->ret.length); status = AE_OK; out_kfree: kfree(context->ret.pointer); kfree(output.pointer); if (status != AE_OK) context->ret.pointer = NULL; return status; } Loading Loading
drivers/acpi/bus.c +18 −8 Original line number Diff line number Diff line Loading @@ -397,6 +397,7 @@ acpi_status acpi_run_osc(acpi_handle handle, struct acpi_osc_context *context) union acpi_object *out_obj; u8 uuid[16]; u32 errors; struct acpi_buffer output = {ACPI_ALLOCATE_BUFFER, NULL}; if (!context) return AE_ERROR; Loading @@ -419,16 +420,16 @@ acpi_status acpi_run_osc(acpi_handle handle, struct acpi_osc_context *context) in_params[3].buffer.length = context->cap.length; in_params[3].buffer.pointer = context->cap.pointer; status = acpi_evaluate_object(handle, "_OSC", &input, &context->ret); status = acpi_evaluate_object(handle, "_OSC", &input, &output); if (ACPI_FAILURE(status)) return status; /* return buffer should have the same length as cap buffer */ if (context->ret.length != context->cap.length) if (!output.length) return AE_NULL_OBJECT; out_obj = context->ret.pointer; if (out_obj->type != ACPI_TYPE_BUFFER) { out_obj = output.pointer; if (out_obj->type != ACPI_TYPE_BUFFER || out_obj->buffer.length != context->cap.length) { acpi_print_osc_error(handle, context, "_OSC evaluation returned wrong type"); status = AE_TYPE; Loading Loading @@ -457,10 +458,19 @@ acpi_status acpi_run_osc(acpi_handle handle, struct acpi_osc_context *context) goto out_kfree; } out_success: return AE_OK; context->ret.length = out_obj->buffer.length; context->ret.pointer = kmalloc(context->ret.length, GFP_KERNEL); if (!context->ret.pointer) { status = AE_NO_MEMORY; goto out_kfree; } memcpy(context->ret.pointer, out_obj->buffer.pointer, context->ret.length); status = AE_OK; out_kfree: kfree(context->ret.pointer); kfree(output.pointer); if (status != AE_OK) context->ret.pointer = NULL; return status; } Loading