1 files changed, 49 insertions, 28 deletions

diff --git a/drivers/acpi/executer/exoparg2.c b/drivers/acpi/executer/exoparg2.c
index e263a5ddd40..5e1abb12c74 100644
--- a/drivers/acpi/executer/exoparg2.c
+++ b/drivers/acpi/executer/exoparg2.c
@@ -138,6 +138,7 @@ acpi_status acpi_ex_opcode_2A_0T_0R(struct acpi_walk_state *walk_state)
 			    acpi_ev_check_for_wake_only_gpe(walk_state->
 							    gpe_event_info);
 			if (ACPI_FAILURE(status)) {
+
 				/* AE_WAKE_ONLY_GPE only error, means ignore this notify */
 
 				return_ACPI_STATUS(AE_OK)
@@ -252,6 +253,7 @@ acpi_status acpi_ex_opcode_2A_2T_1R(struct acpi_walk_state *walk_state)
 	acpi_ut_remove_reference(return_desc2);
 
 	if (ACPI_FAILURE(status)) {
+
 		/* Delete the return object */
 
 		acpi_ut_remove_reference(return_desc1);
@@ -287,6 +289,7 @@ acpi_status acpi_ex_opcode_2A_1T_1R(struct acpi_walk_state *walk_state)
 	/* Execute the opcode */
 
 	if (walk_state->op_info->flags & AML_MATH) {
+
 		/* All simple math opcodes (add, etc.) */
 
 		return_desc = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
@@ -383,54 +386,70 @@ acpi_status acpi_ex_opcode_2A_1T_1R(struct acpi_walk_state *walk_state)
 			goto cleanup;
 		}
 
+		/* Initialize the Index reference object */
+
 		index = operand[1]->integer.value;
+		return_desc->reference.offset = (u32) index;
+		return_desc->reference.opcode = AML_INDEX_OP;
+		return_desc->reference.object = operand[0];
 
-		/* At this point, the Source operand is a Package, Buffer, or String */
+		/*
+		 * At this point, the Source operand is a String, Buffer, or Package.
+		 * Verify that the index is within range.
+		 */
+		switch (ACPI_GET_OBJECT_TYPE(operand[0])) {
+		case ACPI_TYPE_STRING:
 
-		if (ACPI_GET_OBJECT_TYPE(operand[0]) == ACPI_TYPE_PACKAGE) {
-			/* Object to be indexed is a Package */
+			if (index >= operand[0]->string.length) {
+				status = AE_AML_STRING_LIMIT;
+			}
+
+			return_desc->reference.target_type =
+			    ACPI_TYPE_BUFFER_FIELD;
+			break;
+
+		case ACPI_TYPE_BUFFER:
+
+			if (index >= operand[0]->buffer.length) {
+				status = AE_AML_BUFFER_LIMIT;
+			}
+
+			return_desc->reference.target_type =
+			    ACPI_TYPE_BUFFER_FIELD;
+			break;
+
+		case ACPI_TYPE_PACKAGE:
 
 			if (index >= operand[0]->package.count) {
-				ACPI_ERROR((AE_INFO,
-					    "Index value (%X%8.8X) beyond package end (%X)",
-					    ACPI_FORMAT_UINT64(index),
-					    operand[0]->package.count));
 				status = AE_AML_PACKAGE_LIMIT;
-				goto cleanup;
 			}
 
 			return_desc->reference.target_type = ACPI_TYPE_PACKAGE;
-			return_desc->reference.object = operand[0];
 			return_desc->reference.where =
 			    &operand[0]->package.elements[index];
-		} else {
-			/* Object to be indexed is a Buffer/String */
+			break;
 
-			if (index >= operand[0]->buffer.length) {
-				ACPI_ERROR((AE_INFO,
-					    "Index value (%X%8.8X) beyond end of buffer (%X)",
-					    ACPI_FORMAT_UINT64(index),
-					    operand[0]->buffer.length));
-				status = AE_AML_BUFFER_LIMIT;
-				goto cleanup;
-			}
+		default:
 
-			return_desc->reference.target_type =
-			    ACPI_TYPE_BUFFER_FIELD;
-			return_desc->reference.object = operand[0];
+			status = AE_AML_INTERNAL;
+			goto cleanup;
+		}
+
+		/* Failure means that the Index was beyond the end of the object */
+
+		if (ACPI_FAILURE(status)) {
+			ACPI_EXCEPTION((AE_INFO, status,
+					"Index (%X%8.8X) is beyond end of object",
+					ACPI_FORMAT_UINT64(index)));
+			goto cleanup;
 		}
 
 		/*
 		 * Add a reference to the target package/buffer/string for the life
-		 * of the index.
+		 * of the index
 		 */
 		acpi_ut_add_reference(operand[0]);
 
-		/* Complete the Index reference object */
-
-		return_desc->reference.opcode = AML_INDEX_OP;
-		return_desc->reference.offset = (u32) index;
-
 		/* Store the reference to the Target */
 
 		status = acpi_ex_store(return_desc, operand[2], walk_state);
@@ -509,6 +528,7 @@ acpi_status acpi_ex_opcode_2A_0T_1R(struct acpi_walk_state *walk_state)
 	/* Execute the Opcode */
 
 	if (walk_state->op_info->flags & AML_LOGICAL_NUMERIC) {
+
 		/* logical_op (Operand0, Operand1) */
 
 		status = acpi_ex_do_logical_numeric_op(walk_state->opcode,
@@ -518,6 +538,7 @@ acpi_status acpi_ex_opcode_2A_0T_1R(struct acpi_walk_state *walk_state)
 						       value, &logical_result);
 		goto store_logical_result;
 	} else if (walk_state->op_info->flags & AML_LOGICAL) {
+
 		/* logical_op (Operand0, Operand1) */
 
 		status = acpi_ex_do_logical_op(walk_state->opcode, operand[0],