Commit c4f78426 authored by Rafael J. Wysocki's avatar Rafael J. Wysocki

Merge branch 'acpica-fixes'

* acpica-fixes:
  ACPICA: Fix handling of buffer-size in acpi_ex_write_data_to_field()
parents 2bbb5fa3 ae6b3e54
...@@ -244,7 +244,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc, ...@@ -244,7 +244,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
{ {
acpi_status status; acpi_status status;
u32 buffer_length; u32 buffer_length;
u32 data_length;
void *buffer; void *buffer;
union acpi_operand_object *buffer_desc; union acpi_operand_object *buffer_desc;
u32 function; u32 function;
...@@ -282,14 +281,12 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc, ...@@ -282,14 +281,12 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
case ACPI_ADR_SPACE_SMBUS: case ACPI_ADR_SPACE_SMBUS:
buffer_length = ACPI_SMBUS_BUFFER_SIZE; buffer_length = ACPI_SMBUS_BUFFER_SIZE;
data_length = ACPI_SMBUS_DATA_SIZE;
function = ACPI_WRITE | (obj_desc->field.attribute << 16); function = ACPI_WRITE | (obj_desc->field.attribute << 16);
break; break;
case ACPI_ADR_SPACE_IPMI: case ACPI_ADR_SPACE_IPMI:
buffer_length = ACPI_IPMI_BUFFER_SIZE; buffer_length = ACPI_IPMI_BUFFER_SIZE;
data_length = ACPI_IPMI_DATA_SIZE;
function = ACPI_WRITE; function = ACPI_WRITE;
break; break;
...@@ -310,7 +307,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc, ...@@ -310,7 +307,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
/* Add header length to get the full size of the buffer */ /* Add header length to get the full size of the buffer */
buffer_length += ACPI_SERIAL_HEADER_SIZE; buffer_length += ACPI_SERIAL_HEADER_SIZE;
data_length = source_desc->buffer.pointer[1];
function = ACPI_WRITE | (accessor_type << 16); function = ACPI_WRITE | (accessor_type << 16);
break; break;
...@@ -318,20 +314,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc, ...@@ -318,20 +314,6 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
return_ACPI_STATUS(AE_AML_INVALID_SPACE_ID); return_ACPI_STATUS(AE_AML_INVALID_SPACE_ID);
} }
#if 0
OBSOLETE ?
/* Check for possible buffer overflow */
if (data_length > source_desc->buffer.length) {
ACPI_ERROR((AE_INFO,
"Length in buffer header (%u)(%u) is greater than "
"the physical buffer length (%u) and will overflow",
data_length, buffer_length,
source_desc->buffer.length));
return_ACPI_STATUS(AE_AML_BUFFER_LIMIT);
}
#endif
/* Create the transfer/bidirectional/return buffer */ /* Create the transfer/bidirectional/return buffer */
buffer_desc = acpi_ut_create_buffer_object(buffer_length); buffer_desc = acpi_ut_create_buffer_object(buffer_length);
...@@ -342,7 +324,8 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc, ...@@ -342,7 +324,8 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc,
/* Copy the input buffer data to the transfer buffer */ /* Copy the input buffer data to the transfer buffer */
buffer = buffer_desc->buffer.pointer; buffer = buffer_desc->buffer.pointer;
memcpy(buffer, source_desc->buffer.pointer, data_length); memcpy(buffer, source_desc->buffer.pointer,
min(buffer_length, source_desc->buffer.length));
/* Lock entire transaction if requested */ /* Lock entire transaction if requested */
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment