4 files changed, 33 insertions, 17 deletions

diff --git a/drivers/acpi/executer/exconfig.c b/drivers/acpi/executer/exconfig.c
index 734b2f2..8bfa6ef 100644
--- a/drivers/acpi/executer/exconfig.c
+++ b/drivers/acpi/executer/exconfig.c
@@ -376,16 +376,22 @@ acpi_ex_load_op (
 		 */
 		status = acpi_ex_read_data_from_field (walk_state, obj_desc, &buffer_desc);
 		if (ACPI_FAILURE (status)) {
-			goto cleanup;
+			return_ACPI_STATUS (status);
 		}
 
 		table_ptr = ACPI_CAST_PTR (struct acpi_table_header,
 				  buffer_desc->buffer.pointer);
 
-		 /* Sanity check the table length */
+		/* All done with the buffer_desc, delete it */
+
+		buffer_desc->buffer.pointer = NULL;
+		acpi_ut_remove_reference (buffer_desc);
+
+		/* Sanity check the table length */
 
 		if (table_ptr->length < sizeof (struct acpi_table_header)) {
-			return_ACPI_STATUS (AE_BAD_HEADER);
+			status = AE_BAD_HEADER;
+			goto cleanup;
 		}
 		break;
 
@@ -413,7 +419,9 @@ acpi_ex_load_op (
 
 	status = acpi_ex_add_table (table_ptr, acpi_gbl_root_node, &ddb_handle);
 	if (ACPI_FAILURE (status)) {
-		goto cleanup;
+		/* On error, table_ptr was deallocated above */
+
+		return_ACPI_STATUS (status);
 	}
 
 	/* Store the ddb_handle into the Target operand */
@@ -421,17 +429,14 @@ acpi_ex_load_op (
 	status = acpi_ex_store (ddb_handle, target, walk_state);
 	if (ACPI_FAILURE (status)) {
 		(void) acpi_ex_unload_table (ddb_handle);
-	}
 
-	return_ACPI_STATUS (status);
+		/* table_ptr was deallocated above */
 
+		return_ACPI_STATUS (status);
+	}
 
 cleanup:
-
-	if (buffer_desc) {
-		acpi_ut_remove_reference (buffer_desc);
-	}
-	else {
+	if (ACPI_FAILURE (status)) {
 		ACPI_MEM_FREE (table_ptr);
 	}
 	return_ACPI_STATUS (status);
diff --git a/drivers/acpi/executer/exfield.c b/drivers/acpi/executer/exfield.c
index 22c8fa4..a690c92 100644
--- a/drivers/acpi/executer/exfield.c
+++ b/drivers/acpi/executer/exfield.c
@@ -87,6 +87,9 @@ acpi_ex_read_data_from_field (
 	if (!obj_desc) {
 		return_ACPI_STATUS (AE_AML_NO_OPERAND);
 	}
+	if (!ret_buffer_desc) {
+		return_ACPI_STATUS (AE_BAD_PARAMETER);
+	}
 
 	if (ACPI_GET_OBJECT_TYPE (obj_desc) == ACPI_TYPE_BUFFER_FIELD) {
 		/*
@@ -182,7 +185,7 @@ exit:
 	if (ACPI_FAILURE (status)) {
 		acpi_ut_remove_reference (buffer_desc);
 	}
-	else if (ret_buffer_desc) {
+	else {
 		*ret_buffer_desc = buffer_desc;
 	}
 
diff --git a/drivers/acpi/executer/exnames.c b/drivers/acpi/executer/exnames.c
index 639f0bd..b6ba1a7 100644
--- a/drivers/acpi/executer/exnames.c
+++ b/drivers/acpi/executer/exnames.c
@@ -438,6 +438,13 @@ acpi_ex_get_name_string (
 		status = AE_AML_BAD_NAME;
 	}
 
+	if (ACPI_FAILURE (status)) {
+		if (name_string) {
+			ACPI_MEM_FREE (name_string);
+		}
+		return_ACPI_STATUS (status);
+	}
+
 	*out_name_string = name_string;
 	*out_name_length = (u32) (aml_address - in_aml_address);
 
diff --git a/drivers/acpi/executer/exoparg1.c b/drivers/acpi/executer/exoparg1.c
index dbdf826..ffc61dd 100644
--- a/drivers/acpi/executer/exoparg1.c
+++ b/drivers/acpi/executer/exoparg1.c
@@ -127,15 +127,16 @@ acpi_ex_opcode_0A_0T_1R (
 
 cleanup:
 
-	if (!walk_state->result_obj) {
-		walk_state->result_obj = return_desc;
-	}
-
 	/* Delete return object on error */
 
-	if (ACPI_FAILURE (status)) {
+	if ((ACPI_FAILURE (status)) || walk_state->result_obj) {
 		acpi_ut_remove_reference (return_desc);
 	}
+	else {
+		/* Save the return value */
+
+		walk_state->result_obj = return_desc;
+	}
 
 	return_ACPI_STATUS (status);
 }