linux-kernel - RE: [PATCH] ACPICA: cleanup method properly on error

Open Source and information security mailing list archives

Message-ID: <94F2FBAB4432B54E8AACC7DFDE6C92E37E4CDC04@ORSMSX110.amr.corp.intel.com>
Date:	Tue, 26 Jul 2016 20:28:49 +0000
From:	"Moore, Robert" <robert.moore@...el.com>
To:	"Moore, Robert" <robert.moore@...el.com>,
	Vegard Nossum <vegard.nossum@...cle.com>,
	"Zheng, Lv" <lv.zheng@...el.com>,
	"Wysocki, Rafael J" <rafael.j.wysocki@...el.com>
CC:	"linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"stable@...r.kernel.org" <stable@...r.kernel.org>,
	"devel@...ica.org" <devel@...ica.org>
Subject: RE: [PATCH] ACPICA: cleanup method properly on error

    /* Put the new state at the head of the walk list */

    if (Thread)
    {
        AcpiDsPushWalkState (WalkState, Thread);
    }

Is there any chance that Thread could be zero?

> -----Original Message-----
> From: Devel [mailto:devel-bounces@...ica.org] On Behalf Of Moore, Robert
> Sent: Tuesday, July 26, 2016 7:40 AM
> To: Vegard Nossum <vegard.nossum@...cle.com>; Zheng, Lv
> <lv.zheng@...el.com>; Wysocki, Rafael J <rafael.j.wysocki@...el.com>
> Cc: linux-acpi@...r.kernel.org; linux-kernel@...r.kernel.org;
> stable@...r.kernel.org; devel@...ica.org
> Subject: Re: [Devel] [PATCH] ACPICA: cleanup method properly on error
> 
> We'll look at this.
> Thanks.
> 
> 
> > -----Original Message-----
> > From: Vegard Nossum [mailto:vegard.nossum@...cle.com]
> > Sent: Friday, July 22, 2016 8:35 AM
> > To: Moore, Robert <robert.moore@...el.com>; Zheng, Lv
> > <lv.zheng@...el.com>; Wysocki, Rafael J <rafael.j.wysocki@...el.com>
> > Cc: linux-acpi@...r.kernel.org; devel@...ica.org; linux-
> > kernel@...r.kernel.org; Vegard Nossum <vegard.nossum@...cle.com>;
> > stable@...r.kernel.org
> > Subject: [PATCH] ACPICA: cleanup method properly on error
> >
> > If the call to acpi_ds_init_aml_walk() fails, then we have to undo the
> > walk state push done by acpi_ds_create_walk_state(). Otherwise, the
> > new walk state (which has just been freed) will remain on the thread's
> > walk_state_list and be dereferenced in acpi_ps_parse_aml() when we try
> > to get the new state.
> >
> > You can observe this when reading e.g.
> >
> >     /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:01/status
> >
> > Cc: stable@...r.kernel.org
> > Signed-off-by: Vegard Nossum <vegard.nossum@...cle.com>
> > ---
> >  drivers/acpi/acpica/dsmethod.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/acpi/acpica/dsmethod.c
> > b/drivers/acpi/acpica/dsmethod.c index 47c7b52..44b50a6 100644
> > --- a/drivers/acpi/acpica/dsmethod.c
> > +++ b/drivers/acpi/acpica/dsmethod.c
> > @@ -596,6 +596,8 @@ cleanup:
> >  	/* On error, we must terminate the method properly */
> >
> >  	acpi_ds_terminate_control_method(obj_desc, next_walk_state);
> > +	if (thread)
> > +		acpi_ds_pop_walk_state(thread);
> >  	acpi_ds_delete_walk_state(next_walk_state);
> >
> >  	return_ACPI_STATUS(status);
> > --
> > 1.9.1
> 
> _______________________________________________
> Devel mailing list
> Devel@...ica.org
> https://lists.acpica.org/mailman/listinfo/devel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives