From: Prarit Bhargava <prarit@redhat.com>
Date: Thu, 15 May 2008 14:28:40 -0400
Subject: [pci] acpiphp_ibm: let ACPI determine _CID buffer size
Message-id: 20080515182820.31149.12551.sendpatchset@prarit.bos.redhat.com
O-Subject: [RHEL5 PATCH]: acpiphp_ibm: Let ACPI determine _CID buffer size
Bugzilla: 428874
RH-Acked-by: John Feeney <jfeeney@redhat.com>

Backport of

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff_plain;h=498fbb5d411fc8f6207c210796c9308bf54a51a5

>From the commit,

"drivers/pci/hotplug/acpiphp_ibm.c:ibm_find_acpi_device() is not
large enough to accommodate data returned by the _CID method
executed from acpi_get_object_info().

This patch eliminates the problem by letting ACPI code
(instead of driver code) determine and obtain a correctly
sized buffer."

Compiled by me, successfully tested by epollard.

Resolves BZ 428874

diff --git a/drivers/pci/hotplug/acpiphp_ibm.c b/drivers/pci/hotplug/acpiphp_ibm.c
index 317457d..de8f18a 100644
--- a/drivers/pci/hotplug/acpiphp_ibm.c
+++ b/drivers/pci/hotplug/acpiphp_ibm.c
@@ -392,33 +392,34 @@ static acpi_status __init ibm_find_acpi_device(acpi_handle handle,
 {
 	acpi_handle *phandle = (acpi_handle *)context;
 	acpi_status status; 
-	struct acpi_device_info info; 
-	struct acpi_buffer info_buffer = {
-		.length = sizeof(struct acpi_device_info),
-		.pointer = &info,
-	};
+	struct acpi_device_info *info;
+	struct acpi_buffer info_buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+	int retval = 0;
 
 	status = acpi_get_object_info(handle, &info_buffer);
 	if (ACPI_FAILURE(status)) {
-		err("%s:  Failed to get device information", __FUNCTION__);
-		return 0;
+		err("%s:  Failed to get device information status=0x%x\n",
+			__FUNCTION__, status);
+		return retval;
 	}
-	info.hardware_id.value[sizeof(info.hardware_id.value) - 1] = '\0';
-
-	if (info.current_status && (info.valid & ACPI_VALID_HID) &&
-			(!strcmp(info.hardware_id.value, IBM_HARDWARE_ID1) ||
-			!strcmp(info.hardware_id.value, IBM_HARDWARE_ID2))) {
-		dbg("found hardware: %s, handle: %p\n", info.hardware_id.value,
-				handle);
+	info = info_buffer.pointer;
+	info->hardware_id.value[sizeof(info->hardware_id.value) - 1] = '\0';
+
+	if (info->current_status && (info->valid & ACPI_VALID_HID) &&
+			(!strcmp(info->hardware_id.value, IBM_HARDWARE_ID1) ||
+			 !strcmp(info->hardware_id.value, IBM_HARDWARE_ID2))) {
+		dbg("found hardware: %s, handle: %p\n",
+			info->hardware_id.value, handle);
 		*phandle = handle;
 		/* returning non-zero causes the search to stop
 		 * and returns this value to the caller of 
 		 * acpi_walk_namespace, but it also causes some warnings
 		 * in the acpi debug code to print...
 		 */
-		return FOUND_APCI;
+		retval = FOUND_APCI;
 	}
-	return 0;
+	kfree(info);
+	return retval;
 }
 
 static int __init ibm_acpiphp_init(void)