lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 15 Sep 2014 12:25:33 -0700 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-kernel@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, stable@...r.kernel.org, "David E. Box" <david.e.box@...ux.intel.com>, Bob Moore <robert.moore@...el.com>, Lv Zheng <lv.zheng@...el.com>, "Rafael J. Wysocki" <rafael.j.wysocki@...el.com> Subject: [PATCH 3.16 094/158] ACPICA: Namespace: Properly null terminate objects detached from a namespace node 3.16-stable review patch. If anyone has any objections, please let me know. ------------------ From: "David E. Box" <david.e.box@...ux.intel.com> commit e23d9b8297546c6ceb7e70771e4915f2a41733cd upstream. Fixes a bug exposed by an ACPICA unit test around the acpi_attach_data()/acpi_detach_data() APIs where the failure to null terminate a detached object led to the creation of a circular linked list (and infinite looping) when the object is reattached. Reported in acpica bugzilla #1063 Link: https://bugs.acpica.org/show_bug.cgi?id=1063 Signed-off-by: David E. Box <david.e.box@...ux.intel.com> Signed-off-by: Bob Moore <robert.moore@...el.com> Signed-off-by: Lv Zheng <lv.zheng@...el.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@...el.com> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org> --- drivers/acpi/acpica/nsobject.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/acpi/acpica/nsobject.c +++ b/drivers/acpi/acpica/nsobject.c @@ -239,6 +239,17 @@ void acpi_ns_detach_object(struct acpi_n } } + /* + * Detach the object from any data objects (which are still held by + * the namespace node) + */ + + if (obj_desc->common.next_object && + ((obj_desc->common.next_object)->common.type == + ACPI_TYPE_LOCAL_DATA)) { + obj_desc->common.next_object = NULL; + } + /* Reset the node type to untyped */ node->type = ACPI_TYPE_ANY; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists