Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1212662
| From | Lv Zheng <lv.zheng@intel.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 03/20] ACPICA: Update parameter validation for data_table_region and load_table. |
| Date | 2015-08-25 04:40 +0200 |
| Message-ID | <q1cjv-1EB-11@gated-at.bofh.it> (permalink) |
| References | <q1c9P-1tt-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: Bob Moore <robert.moore@intel.com>
ACPICA commit 51ab555e60b4a3de3cc4a846e86d0de255be441a
Add additional validation for the table signature and
the OEM strings. Eliminates buffer read overrun in data_table_region.
ACPICA BZ 1184.
Link: https://bugs.acpica.org/show_bug.cgi?id=1184
Link: https://github.com/acpica/acpica/commit/51ab555e
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
---
drivers/acpi/acpica/actables.h | 2 ++
drivers/acpi/acpica/dsopcode.c | 31 ++++++++++++++++++++-----------
drivers/acpi/acpica/exconfig.c | 8 --------
drivers/acpi/acpica/tbfind.c | 15 ++++++++++++++-
drivers/acpi/acpica/tbutils.c | 33 +++++++++++++++++++++++++++++++++
5 files changed, 69 insertions(+), 20 deletions(-)
diff --git a/drivers/acpi/acpica/actables.h b/drivers/acpi/acpica/actables.h
index 7e0b6f1..58497b7 100644
--- a/drivers/acpi/acpica/actables.h
+++ b/drivers/acpi/acpica/actables.h
@@ -164,4 +164,6 @@ acpi_tb_install_fixed_table(acpi_physical_address address,
acpi_status acpi_tb_parse_root_table(acpi_physical_address rsdp_address);
+u8 acpi_is_valid_signature(char *signature);
+
#endif /* __ACTABLES_H__ */
diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
index ea0cc4e..81d7b986 100644
--- a/drivers/acpi/acpica/dsopcode.c
+++ b/drivers/acpi/acpica/dsopcode.c
@@ -480,8 +480,8 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,
union acpi_operand_object **operand;
struct acpi_namespace_node *node;
union acpi_parse_object *next_op;
- u32 table_index;
struct acpi_table_header *table;
+ u32 table_index;
ACPI_FUNCTION_TRACE_PTR(ds_eval_table_region_operands, op);
@@ -504,6 +504,8 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,
return_ACPI_STATUS(status);
}
+ operand = &walk_state->operands[0];
+
/*
* Resolve the Signature string, oem_id string,
* and oem_table_id string operands
@@ -511,32 +513,34 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,
status = acpi_ex_resolve_operands(op->common.aml_opcode,
ACPI_WALK_OPERANDS, walk_state);
if (ACPI_FAILURE(status)) {
- return_ACPI_STATUS(status);
+ goto cleanup;
}
- operand = &walk_state->operands[0];
-
/* Find the ACPI table */
status = acpi_tb_find_table(operand[0]->string.pointer,
operand[1]->string.pointer,
operand[2]->string.pointer, &table_index);
if (ACPI_FAILURE(status)) {
- return_ACPI_STATUS(status);
+ if (status == AE_NOT_FOUND) {
+ ACPI_ERROR((AE_INFO,
+ "ACPI Table [%4.4s] OEM:(%s, %s) not found in RSDT/XSDT",
+ operand[0]->string.pointer,
+ operand[1]->string.pointer,
+ operand[2]->string.pointer));
+ }
+ goto cleanup;
}
- acpi_ut_remove_reference(operand[0]);
- acpi_ut_remove_reference(operand[1]);
- acpi_ut_remove_reference(operand[2]);
-
status = acpi_get_table_by_index(table_index, &table);
if (ACPI_FAILURE(status)) {
- return_ACPI_STATUS(status);
+ goto cleanup;
}
obj_desc = acpi_ns_get_attached_object(node);
if (!obj_desc) {
- return_ACPI_STATUS(AE_NOT_EXIST);
+ status = AE_NOT_EXIST;
+ goto cleanup;
}
obj_desc->region.address = ACPI_PTR_TO_PHYSADDR(table);
@@ -551,6 +555,11 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,
obj_desc->region.flags |= AOPOBJ_DATA_VALID;
+cleanup:
+ acpi_ut_remove_reference(operand[0]);
+ acpi_ut_remove_reference(operand[1]);
+ acpi_ut_remove_reference(operand[2]);
+
return_ACPI_STATUS(status);
}
diff --git a/drivers/acpi/acpica/exconfig.c b/drivers/acpi/acpica/exconfig.c
index 24a4c5c..b540913 100644
--- a/drivers/acpi/acpica/exconfig.c
+++ b/drivers/acpi/acpica/exconfig.c
@@ -162,14 +162,6 @@ acpi_ex_load_table_op(struct acpi_walk_state *walk_state,
ACPI_FUNCTION_TRACE(ex_load_table_op);
- /* Validate lengths for the Signature, oem_id, and oem_table_id strings */
-
- if ((operand[0]->string.length > ACPI_NAME_SIZE) ||
- (operand[1]->string.length > ACPI_OEM_ID_SIZE) ||
- (operand[2]->string.length > ACPI_OEM_TABLE_ID_SIZE)) {
- return_ACPI_STATUS(AE_AML_STRING_LIMIT);
- }
-
/* Find the ACPI table in the RSDT/XSDT */
status = acpi_tb_find_table(operand[0]->string.pointer,
diff --git a/drivers/acpi/acpica/tbfind.c b/drivers/acpi/acpica/tbfind.c
index 119c84a..405529d 100644
--- a/drivers/acpi/acpica/tbfind.c
+++ b/drivers/acpi/acpica/tbfind.c
@@ -68,12 +68,25 @@ acpi_status
acpi_tb_find_table(char *signature,
char *oem_id, char *oem_table_id, u32 *table_index)
{
- u32 i;
acpi_status status;
struct acpi_table_header header;
+ u32 i;
ACPI_FUNCTION_TRACE(tb_find_table);
+ /* Validate the input table signature */
+
+ if (!acpi_is_valid_signature(signature)) {
+ return_ACPI_STATUS(AE_BAD_SIGNATURE);
+ }
+
+ /* Don't allow the OEM strings to be too long */
+
+ if ((strlen(oem_id) > ACPI_OEM_ID_SIZE) ||
+ (strlen(oem_table_id) > ACPI_OEM_TABLE_ID_SIZE)) {
+ return_ACPI_STATUS(AE_AML_STRING_LIMIT);
+ }
+
/* Normalize the input strings */
memset(&header, 0, sizeof(struct acpi_table_header));
diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index 568ac0e..db7f2aa 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -412,3 +412,36 @@ next_table:
return_ACPI_STATUS(AE_OK);
}
+
+/*******************************************************************************
+ *
+ * FUNCTION: acpi_is_valid_signature
+ *
+ * PARAMETERS: signature - Sig string to be validated
+ *
+ * RETURN: TRUE if signature is correct length and has valid characters
+ *
+ * DESCRIPTION: Validate an ACPI table signature.
+ *
+ ******************************************************************************/
+
+u8 acpi_is_valid_signature(char *signature)
+{
+ u32 i;
+
+ /* Validate the signature length */
+
+ if (strlen(signature) != ACPI_NAME_SIZE) {
+ return (FALSE);
+ }
+
+ /* Validate each character in the signature */
+
+ for (i = 0; i < ACPI_NAME_SIZE; i++) {
+ if (!acpi_ut_valid_acpi_char(signature[i], i)) {
+ return (FALSE);
+ }
+ }
+
+ return (TRUE);
+}
--
1.7.10
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 00/20] ACPICA: 20150818 Release Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 08/20] ACPICA: Headers: Fix some comments, no functional change. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 02/20] ACPICA: Disassembler: Remove duplicate code in _PLD processing. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 06/20] ACPICA: Tables: Fix global table list issues by removing fixed table indexes. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 12/20] ACPICA: Add additional debug info/statements. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 04/20] ACPICA: Disassembler: Update for new listing mode. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 07/20] ACPICA: Tables: Cleanup to reduce FACS globals. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 09/20] ACPICA: acpinames: Add new options and wildcard support. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 05/20] ACPICA: Update info messages during ACPICA init. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 11/20] ACPICA: Table handling: Cleanup and update debug output for tools. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 10/20] ACPICA: acpiexec/acpinames: Support very large number of ACPI tables. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 01/20] ACPICA: Correctly cleanup after a ACPI table load failure. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:30 +0200 [PATCH 19/20] ACPICA: Debugger: Cleanup debugging outputs to dump name path without trailing underscores. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:40 +0200 [PATCH 03/20] ACPICA: Update parameter validation for data_table_region and load_table. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:40 +0200 [PATCH 16/20] ACPICA: Debugger: Split debugger initialization/termination APIs. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:40 +0200 [PATCH 14/20] ACPICA: Make the max-number-of-loops runtime configurable. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:40 +0200 [PATCH 20/20] ACPICA: Update version to 20150818. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:40 +0200 [PATCH 17/20] ACPICA: Disassembler: Cleanup acpi_gbl_db_opt_disasm. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:40 +0200 [PATCH 13/20] ACPICA: Debugger: Add option to display namespace summary/counts. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:40 +0200 [PATCH 18/20] ACPICA: Disassembler: Cleanup acpi_gbl_db_opt_verbose acpiexec usage. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:40 +0200 [PATCH 15/20] ACPICA: Header support to improve compatibility with MSVC. Lv Zheng <lv.zheng@intel.com> - 2015-08-25 04:40 +0200 Re: [PATCH 00/20] ACPICA: 20150818 Release "Rafael J. Wysocki" <rjw@rjwysocki.net> - 2015-08-26 01:30 +0200
csiph-web