ACPI: ACPICA 20060707

Added the ACPI_PACKED_POINTERS_NOT_SUPPORTED macro to
support C compilers that do not allow the initialization
of address pointers within packed structures - even though
the hardware itself may support misaligned transfers. Some
of the debug data structures are packed by default to
minimize size.

Added an error message for the case where
acpi_os_get_thread_id() returns zero. A non-zero value is
required by the core ACPICA code to ensure the proper
operation of AML mutexes and recursive control methods.

The DSDT is now the only ACPI table that determines whether
the AML interpreter is in 32-bit or 64-bit mode. Not really
a functional change, but the hooks for per-table 32/64
switching have been removed from the code. A clarification
to the ACPI specification is forthcoming in ACPI 3.0B.

Fixed a possible leak of an Owner ID in the error
path of tbinstal.c acpi_tb_init_table_descriptor() and
migrated all table OwnerID deletion to a single place in
acpi_tb_uninstall_table() to correct possible leaks when using
the acpi_tb_delete_tables_by_type() interface (with assistance
from Lance Ortiz.)

Fixed a problem with Serialized control methods where the
semaphore associated with the method could be over-signaled
after multiple method invocations.

Fixed two issues with the locking of the internal
namespace data structure. Both the Unload() operator and
acpi_unload_table() interface now lock the namespace during
the namespace deletion associated with the table unload
(with assistance from Linn Crosetto.)

Fixed problem reports (Valery Podrezov) integrated: -
Eliminate unnecessary memory allocation for CreateXxxxField
http://bugzilla.kernel.org/show_bug.cgi?id=5426

Fixed problem reports (Fiodor Suietov) integrated: -
Incomplete cleanup branches in AcpiTbGetTableRsdt (BZ 369)
- On Address Space handler deletion, needless deactivation
call (BZ 374) - AcpiRemoveAddressSpaceHandler: validate
Device handle parameter (BZ 375) - Possible memory leak,
Notify sub-objects of Processor, Power, ThermalZone (BZ
376) - AcpiRemoveAddressSpaceHandler: validate Handler
parameter (BZ 378) - Minimum Length of RSDT should be
validated (BZ 379) - AcpiRemoveNotifyHandler: return
AE_NOT_EXIST if Processor Obj has no Handler (BZ (380)
- AcpiUnloadTable: return AE_NOT_EXIST if no table of
specified type loaded (BZ 381)

Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>

4 files changed, 71 insertions, 21 deletions

diff --git a/drivers/acpi/tables/tbget.c b/drivers/acpi/tables/tbget.c
index 99eacce..7856db7 100644
--- a/drivers/acpi/tables/tbget.c
+++ b/drivers/acpi/tables/tbget.c
@@ -320,6 +320,16 @@ acpi_tb_get_this_table(struct acpi_pointer *address,
 
 	ACPI_FUNCTION_TRACE(tb_get_this_table);
 
+	/* Validate minimum length */
+
+	if (header->length < sizeof(struct acpi_table_header)) {
+		ACPI_ERROR((AE_INFO,
+			    "Table length (%X) is smaller than minimum (%X)",
+			    header->length, sizeof(struct acpi_table_header)));
+
+		return_ACPI_STATUS(AE_INVALID_TABLE_LENGTH);
+	}
+
 	/*
 	 * Flags contains the current processor mode (Virtual or Physical
 	 * addressing) The pointer_type is either Logical or Physical
@@ -356,7 +366,7 @@ acpi_tb_get_this_table(struct acpi_pointer *address,
 		 */
 		status = acpi_os_map_memory(address->pointer.physical,
 					    (acpi_size) header->length,
-					    (void *)&full_table);
+					    ACPI_CAST_PTR(void, &full_table));
 		if (ACPI_FAILURE(status)) {
 			ACPI_ERROR((AE_INFO,
 				    "Could not map memory for table [%4.4s] at %8.8X%8.8X for length %X",
diff --git a/drivers/acpi/tables/tbinstal.c b/drivers/acpi/tables/tbinstal.c
index 7ca2df7..1668a23 100644
--- a/drivers/acpi/tables/tbinstal.c
+++ b/drivers/acpi/tables/tbinstal.c
@@ -256,7 +256,7 @@ acpi_tb_init_table_descriptor(acpi_table_type table_type,
 
 	status = acpi_ut_allocate_owner_id(&table_desc->owner_id);
 	if (ACPI_FAILURE(status)) {
-		return_ACPI_STATUS(status);
+		goto error_exit1;
 	}
 
 	/* Install the table into the global data structure */
@@ -274,8 +274,8 @@ acpi_tb_init_table_descriptor(acpi_table_type table_type,
 		 * at this location, so return an error.
 		 */
 		if (list_head->next) {
-			ACPI_FREE(table_desc);
-			return_ACPI_STATUS(AE_ALREADY_EXISTS);
+			status = AE_ALREADY_EXISTS;
+			goto error_exit2;
 		}
 
 		table_desc->next = list_head->next;
@@ -335,6 +335,17 @@ acpi_tb_init_table_descriptor(acpi_table_type table_type,
 	table_info->owner_id = table_desc->owner_id;
 	table_info->installed_desc = table_desc;
 	return_ACPI_STATUS(AE_OK);
+
+	/* Error exit with cleanup */
+
+      error_exit2:
+
+	acpi_ut_release_owner_id(&table_desc->owner_id);
+
+      error_exit1:
+
+	ACPI_FREE(table_desc);
+	return_ACPI_STATUS(status);
 }
 
 /*******************************************************************************
@@ -525,6 +536,10 @@ struct acpi_table_desc *acpi_tb_uninstall_table(struct acpi_table_desc
 
 	acpi_tb_delete_single_table(table_desc);
 
+	/* Free the owner ID associated with this table */
+
+	acpi_ut_release_owner_id(&table_desc->owner_id);
+
 	/* Free the table descriptor */
 
 	next_desc = table_desc->next;
diff --git a/drivers/acpi/tables/tbrsdt.c b/drivers/acpi/tables/tbrsdt.c
index abcb08c..0ad3dbb 100644
--- a/drivers/acpi/tables/tbrsdt.c
+++ b/drivers/acpi/tables/tbrsdt.c
@@ -183,6 +183,17 @@ acpi_status acpi_tb_validate_rsdt(struct acpi_table_header *table_ptr)
 
 	ACPI_FUNCTION_ENTRY();
 
+	/* Validate minimum length */
+
+	if (table_ptr->length < sizeof(struct acpi_table_header)) {
+		ACPI_ERROR((AE_INFO,
+			    "RSDT/XSDT length (%X) is smaller than minimum (%X)",
+			    table_ptr->length,
+			    sizeof(struct acpi_table_header)));
+
+		return (AE_INVALID_TABLE_LENGTH);
+	}
+
 	/* Search for appropriate signature, RSDT or XSDT */
 
 	if (acpi_gbl_root_table_type == ACPI_TABLE_TYPE_RSDT) {
@@ -210,7 +221,7 @@ acpi_status acpi_tb_validate_rsdt(struct acpi_table_header *table_ptr)
 			ACPI_ERROR((AE_INFO, "Looking for XSDT"));
 		}
 
-		ACPI_DUMP_BUFFER((char *)table_ptr, 48);
+		ACPI_DUMP_BUFFER(ACPI_CAST_PTR(char, table_ptr), 48);
 		return (AE_BAD_SIGNATURE);
 	}
 
@@ -258,7 +269,7 @@ acpi_status acpi_tb_get_table_rsdt(void)
 
 	status = acpi_tb_validate_rsdt(table_info.pointer);
 	if (ACPI_FAILURE(status)) {
-		return_ACPI_STATUS(status);
+		goto error_cleanup;
 	}
 
 	/* Get the number of tables defined in the RSDT or XSDT */
@@ -270,14 +281,14 @@ acpi_status acpi_tb_get_table_rsdt(void)
 
 	status = acpi_tb_convert_to_xsdt(&table_info);
 	if (ACPI_FAILURE(status)) {
-		return_ACPI_STATUS(status);
+		goto error_cleanup;
 	}
 
 	/* Save the table pointers and allocation info */
 
 	status = acpi_tb_init_table_descriptor(ACPI_TABLE_ID_XSDT, &table_info);
 	if (ACPI_FAILURE(status)) {
-		return_ACPI_STATUS(status);
+		goto error_cleanup;
 	}
 
 	acpi_gbl_XSDT =
@@ -285,4 +296,12 @@ acpi_status acpi_tb_get_table_rsdt(void)
 
 	ACPI_DEBUG_PRINT((ACPI_DB_INFO, "XSDT located at %p\n", acpi_gbl_XSDT));
 	return_ACPI_STATUS(status);
+
+      error_cleanup:
+
+	/* Free table allocated by acpi_tb_get_table */
+
+	acpi_tb_delete_single_table(&table_info);
+
+	return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/tables/tbxface.c b/drivers/acpi/tables/tbxface.c
index 4e91f29..7767987 100644
--- a/drivers/acpi/tables/tbxface.c
+++ b/drivers/acpi/tables/tbxface.c
@@ -134,8 +134,8 @@ ACPI_EXPORT_SYMBOL(acpi_load_tables)
  * RETURN:      Status
  *
  * DESCRIPTION: This function is called to load a table from the caller's
- *              buffer.  The buffer must contain an entire ACPI Table including
- *              a valid header.  The header fields will be verified, and if it
+ *              buffer. The buffer must contain an entire ACPI Table including
+ *              a valid header. The header fields will be verified, and if it
  *              is determined that the table is invalid, the call will fail.
  *
  ******************************************************************************/
@@ -245,15 +245,18 @@ acpi_status acpi_unload_table(acpi_table_type table_type)
 	/* Find all tables of the requested type */
 
 	table_desc = acpi_gbl_table_lists[table_type].next;
+	if (!table_desc) {
+		return_ACPI_STATUS(AE_NOT_EXIST);
+	}
+
 	while (table_desc) {
 		/*
-		 * Delete all namespace entries owned by this table.  Note that these
-		 * entries can appear anywhere in the namespace by virtue of the AML
-		 * "Scope" operator.  Thus, we need to track ownership by an ID, not
+		 * Delete all namespace objects owned by this table. Note that these
+		 * objects can appear anywhere in the namespace by virtue of the AML
+		 * "Scope" operator. Thus, we need to track ownership by an ID, not
 		 * simply a position within the hierarchy
 		 */
 		acpi_ns_delete_namespace_by_owner(table_desc->owner_id);
-		acpi_ut_release_owner_id(&table_desc->owner_id);
 		table_desc = table_desc->next;
 	}
 
@@ -275,12 +278,12 @@ ACPI_EXPORT_SYMBOL(acpi_unload_table)
  *                                see acpi_gbl_acpi_table_flag
  *              out_table_header - pointer to the struct acpi_table_header if successful
  *
- * DESCRIPTION: This function is called to get an ACPI table header.  The caller
+ * DESCRIPTION: This function is called to get an ACPI table header. The caller
  *              supplies an pointer to a data area sufficient to contain an ACPI
  *              struct acpi_table_header structure.
  *
  *              The header contains a length field that can be used to determine
- *              the size of the buffer needed to contain the entire table.  This
+ *              the size of the buffer needed to contain the entire table. This
  *              function is not valid for the RSD PTR table since it does not
  *              have a standard header and is fixed length.
  *
@@ -322,7 +325,8 @@ acpi_get_table_header(acpi_table_type table_type,
 
 	/* Copy the header to the caller's buffer */
 
-	ACPI_MEMCPY((void *)out_table_header, (void *)tbl_ptr,
+	ACPI_MEMCPY(ACPI_CAST_PTR(void, out_table_header),
+		    ACPI_CAST_PTR(void, tbl_ptr),
 		    sizeof(struct acpi_table_header));
 
 	return_ACPI_STATUS(status);
@@ -344,10 +348,10 @@ ACPI_EXPORT_SYMBOL(acpi_get_table_header)
  *
  * RETURN:      Status
  *
- * DESCRIPTION: This function is called to get an ACPI table.  The caller
+ * DESCRIPTION: This function is called to get an ACPI table. The caller
  *              supplies an out_buffer large enough to contain the entire ACPI
- *              table.  The caller should call the acpi_get_table_header function
- *              first to determine the buffer size needed.  Upon completion
+ *              table. The caller should call the acpi_get_table_header function
+ *              first to determine the buffer size needed. Upon completion
  *              the out_buffer->Length field will indicate the number of bytes
  *              copied into the out_buffer->buf_ptr buffer. This table will be
  *              a complete table including the header.
@@ -417,7 +421,9 @@ acpi_get_table(acpi_table_type table_type,
 
 	/* Copy the table to the buffer */
 
-	ACPI_MEMCPY((void *)ret_buffer->pointer, (void *)tbl_ptr, table_length);
+	ACPI_MEMCPY(ACPI_CAST_PTR(void, ret_buffer->pointer),
+		    ACPI_CAST_PTR(void, tbl_ptr), table_length);
+
 	return_ACPI_STATUS(AE_OK);
 }