xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Garpu 0
Kode Masalah Tarik Permintaan Actions Packages Projects Rilis Wiki Kegiatan

ACPICA: Resources: Fix loop termination for the get AML length function.

Telusuri Sumber 
The loop terminates on a NULL resource pointer, which can never
happen since the loop simply increments a valid resource pointer.
This fix changes the loop to terminate on an end-of-buffer condition.

Problem can be seen by callers to AcpiSetCurrentResources with an
invalid or corrupted resource descriptor; or a resource descriptor
without an END_TAG descriptor.

(refined by Bob Moore)
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
Lv Zheng
2013-11-21 12:17:34 +08:00
committed by Rafael J. Wysocki
orang tua c38f671e39
melakukan 9a0a359725
4 mengubah file dengan 28 tambahan dan 25 penghapusan
Download Patch File Download Diff File Expand all files Collapse all files

36
drivers/acpi/acpica/rscreate.c
Melihat File

@@ -418,22 +418,21 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
*
* FUNCTION: acpi_rs_create_aml_resources
*
* PARAMETERS: linked_list_buffer - Pointer to the resource linked list
* output_buffer - Pointer to the user's buffer
* PARAMETERS: resource_list - Pointer to the resource list buffer
* output_buffer - Where the AML buffer is returned
*
* RETURN: Status AE_OK if okay, else a valid acpi_status code.
* If the output_buffer is too small, the error will be
* AE_BUFFER_OVERFLOW and output_buffer->Length will point
* to the size buffer needed.
*
* DESCRIPTION: Takes the linked list of device resources and
* creates a bytestream to be used as input for the
* _SRS control method.
* DESCRIPTION: Converts a list of device resources to an AML bytestream
* to be used as input for the _SRS control method.
*
******************************************************************************/
acpi_status
acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
acpi_rs_create_aml_resources(struct acpi_buffer *resource_list,
struct acpi_buffer *output_buffer)
{
acpi_status status;
@@ -441,16 +440,16 @@ acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
ACPI_FUNCTION_TRACE(rs_create_aml_resources);
ACPI_DEBUG_PRINT((ACPI_DB_INFO, "LinkedListBuffer = %p\n",
linked_list_buffer));
/* Params already validated, no need to re-validate here */
/*
* Params already validated, so we don't re-validate here
*
* Pass the linked_list_buffer into a module that calculates
* the buffer size needed for the byte stream.
*/
status = acpi_rs_get_aml_length(linked_list_buffer, &aml_size_needed);
ACPI_DEBUG_PRINT((ACPI_DB_INFO, "ResourceList Buffer = %p\n",
resource_list->pointer));
/* Get the buffer size needed for the AML byte stream */
status = acpi_rs_get_aml_length(resource_list->pointer,
resource_list->length,
&aml_size_needed);
ACPI_DEBUG_PRINT((ACPI_DB_INFO, "AmlSizeNeeded=%X, %s\n",
(u32)aml_size_needed, acpi_format_exception(status)));
@@ -467,10 +466,9 @@ acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
/* Do the conversion */
status =
acpi_rs_convert_resources_to_aml(linked_list_buffer,
aml_size_needed,
output_buffer->pointer);
status = acpi_rs_convert_resources_to_aml(resource_list->pointer,
aml_size_needed,
output_buffer->pointer);
if (ACPI_FAILURE(status)) {
return_ACPI_STATUS(status);
}