linux-kernel - Re: [PATCH 20/27] ACPICA: Tables: Fix invalid pointer accesses in acpi_tb_parse_root

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+5PVA58OC2dbk5oqTSQjOsCVzYfF+8nfat1Nbd2cCRTxbn5Pg@mail.gmail.com>
Date:	Sat, 3 May 2014 08:59:14 -0400
From:	Josh Boyer <jwboyer@...oraproject.org>
To:	Lv Zheng <lv.zheng@...el.com>
Cc:	"Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
	Len Brown <len.brown@...el.com>, Lv Zheng <zetalog@...il.com>,
	"Linux-Kernel@...r. Kernel. Org" <linux-kernel@...r.kernel.org>,
	"linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>,
	Bob Moore <robert.moore@...el.com>
Subject: Re: [PATCH 20/27] ACPICA: Tables: Fix invalid pointer accesses in acpi_tb_parse_root_table().

On Tue, Apr 29, 2014 at 10:05 PM, Lv Zheng <lv.zheng@...el.com> wrote:
> The commit of back porting Linux XSDT validation mechanism has introduced
> a regreession:
>   Commit: 671cc68dc61f029d44b43a681356078e02d8dab8
>   Subject: ACPICA: Back port and refine validation of the XSDT root table.
> There is a pointer still accessed after unmapping.
>
> This patch fixes this issue.  Lv Zheng.
>
> Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=73911
> Buglink: https://bugs.archlinux.org/task/39811
> Signed-off-by: Lv Zheng <lv.zheng@...el.com>
> Reported-and-tested-by: Bruce Chiarelli <mano155@...il.com>
> Reported-and-tested-by: Spyros Stathopoulos <spystath@...il.com>
> Signed-off-by: Bob Moore <robert.moore@...el.com>
> Cc: <stable@...r.kernel.org> # 3.14.x: 671cc68: ACPICA: Back port and refine validation of the XSDT root table.

This patch should get into 3.15-rcX soon.  It fixes a known regression
that prevents booting on machines with AMI firmware, and that is
present in 3.14 so we need it for stable as well.  Rafael?

josh

> ---
>  drivers/acpi/acpica/tbutils.c |    7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
> index 6c31d77..e1638ad 100644
> --- a/drivers/acpi/acpica/tbutils.c
> +++ b/drivers/acpi/acpica/tbutils.c
> @@ -355,6 +355,7 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
>         u32 table_count;
>         struct acpi_table_header *table;
>         acpi_physical_address address;
> +       acpi_physical_address rsdt_address;
>         u32 length;
>         u8 *table_entry;
>         acpi_status status;
> @@ -383,11 +384,14 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
>                  * as per the ACPI specification.
>                  */
>                 address = (acpi_physical_address) rsdp->xsdt_physical_address;
> +               rsdt_address =
> +                   (acpi_physical_address) rsdp->rsdt_physical_address;
>                 table_entry_size = ACPI_XSDT_ENTRY_SIZE;
>         } else {
>                 /* Root table is an RSDT (32-bit physical addresses) */
>
>                 address = (acpi_physical_address) rsdp->rsdt_physical_address;
> +               rsdt_address = address;
>                 table_entry_size = ACPI_RSDT_ENTRY_SIZE;
>         }
>
> @@ -410,8 +414,7 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
>
>                         /* Fall back to the RSDT */
>
> -                       address =
> -                           (acpi_physical_address) rsdp->rsdt_physical_address;
> +                       address = rsdt_address;
>                         table_entry_size = ACPI_RSDT_ENTRY_SIZE;
>                 }
>         }
> --
> 1.7.10
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/