Skip to contentSkip to conversation

acpi: fix null pointer deference of hardware_id string

PATCH In review Lin Ming 2 participants 3 messages Aug 13, 2009 – Sep 27, 2009

Subsystems (4)
Linux-next tree ACPI PCI Agpgart driver
lore
Share & tools
lore

Lin Ming

author
#0 lore raw

PATCH 1/1 acpi: fix null pointer deference of hardware_id string

From: Lin Ming <[email protected]>
Date: Thu, 13 Aug 2009 11:04:47 +0800
Subject: [PATCH] acpi: fix null pointer deference of hardware_id string

This regression was caused by commit ed44482
"ACPICA: Major update for acpi_get_object_info external interface"

Don't need to set hardware_id string \0 terminated here, acpi_get_object_info already handles it.

Tested-by Thomas Meyer <[email protected]>
Signed-off-by Lin Ming <[email protected]>
---
 drivers/char/agp/hp-agp.c         |    6 ++++--
 drivers/pci/hotplug/acpiphp_ibm.c |    1 -
 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/char/agp/hp-agp.c +4 -2
index 7bead4c..d83c4a8 100644
@@ -492,8 +492,10 @@ zx1_gart_probe (acpi_handle obj, u32 depth, void *context, void **ret)
 		status = acpi_get_object_info(handle, &info);
 		if (ACPI_SUCCESS(status)) {
 			/* TBD check _CID also */
-			info->hardware_id.string[sizeof(info->hardware_id.length)-1] = '\0';
-			match = (strcmp(info->hardware_id.string, "HWP0001") == 0);
+			if (info->valid & ACPI_VALID_HID)
+				match = !strcmp(info->hardware_id.string, "HWP0001");
+			else
+				match = 0;
 			kfree(info);
 			if (match) {
 				status = hp_acpi_csr_space(handle, &sba_hpa, &length);
drivers/pci/hotplug/acpiphp_ibm.c +0 -1
index a9d926b..e7be66d 100644
@@ -406,7 +406,6 @@ static acpi_status __init ibm_find_acpi_device(acpi_handle handle,
 			__func__, status);
 		return retval;
 	}
-	info->hardware_id.string[sizeof(info->hardware_id.length) - 1] = '\0';
 
 	if (info->current_status && (info->valid & ACPI_VALID_HID) &&
 			(!strcmp(info->hardware_id.string, IBM_HARDWARE_ID1) ||
#1 lore raw

Am Donnerstag, den 13.08.2009, 11:12 +0800 schrieb Lin Ming:

Quoted 2 lines

From: Lin Ming <[email protected]>
Date: Thu, 13 Aug 2009 11:04:47 +0800

Another month, another git repository...

Are there any reasons why the patch below didn't land in linus' git tree?

Quoted 46 lines

Subject: [PATCH] acpi: fix null pointer deference of hardware_id string

This regression was caused by commit ed44482
"ACPICA: Major update for acpi_get_object_info external interface"

Don't need to set hardware_id string \0 terminated here, acpi_get_object_info already handles it.

Tested-by Thomas Meyer <[email protected]>
Signed-off-by Lin Ming <[email protected]>
---
 drivers/char/agp/hp-agp.c         |    6 ++++--
 drivers/pci/hotplug/acpiphp_ibm.c |    1 -
 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/char/agp/hp-agp.c +4 -2
index 7bead4c..d83c4a8 100644
@@ -492,8 +492,10 @@ zx1_gart_probe (acpi_handle obj, u32 depth, void *context, void **ret)
 		status = acpi_get_object_info(handle, &info);
 		if (ACPI_SUCCESS(status)) {
 			/* TBD check _CID also */
-			info->hardware_id.string[sizeof(info->hardware_id.length)-1] = '\0';
-			match = (strcmp(info->hardware_id.string, "HWP0001") == 0);
+			if (info->valid & ACPI_VALID_HID)
+				match = !strcmp(info->hardware_id.string, "HWP0001");
+			else
+				match = 0;
 			kfree(info);
 			if (match) {
 				status = hp_acpi_csr_space(handle, &sba_hpa, &length);
drivers/pci/hotplug/acpiphp_ibm.c +0 -1
index a9d926b..e7be66d 100644
@@ -406,7 +406,6 @@ static acpi_status __init ibm_find_acpi_device(acpi_handle handle,
 			__func__, status);
 		return retval;
 	}
-	info->hardware_id.string[sizeof(info->hardware_id.length) - 1] = '\0';
 
 	if (info->current_status && (info->valid & ACPI_VALID_HID) &&
 			(!strcmp(info->hardware_id.string, IBM_HARDWARE_ID1) ||
author
#2 lore raw
Quoted 8 lines · Thomas Meyer

Am Donnerstag, den 13.08.2009, 11:12 +0800 schrieb Lin Ming:

Quoted 2 lines

From: Lin Ming <[email protected]>
Date: Thu, 13 Aug 2009 11:04:47 +0800

Another month, another git repository...

Are there any reasons why the patch below didn't land in linus' git tree?

A similar patch from Bjorn Helgaas is in Linus' tree.

ACPICA: fixup after acpi_get_object_info() change
b24715027aab5e586c4ab1d035f3e543307dea69

Lin Ming

Quoted 48 lines
Quoted 47 lines

Subject: [PATCH] acpi: fix null pointer deference of hardware_id string

This regression was caused by commit ed44482
"ACPICA: Major update for acpi_get_object_info external interface"

Don't need to set hardware_id string \0 terminated here, acpi_get_object_info already handles it.

Tested-by Thomas Meyer <[email protected]>
Signed-off-by Lin Ming <[email protected]>
---
 drivers/char/agp/hp-agp.c         |    6 ++++--
 drivers/pci/hotplug/acpiphp_ibm.c |    1 -
 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/char/agp/hp-agp.c +4 -2
index 7bead4c..d83c4a8 100644
@@ -492,8 +492,10 @@ zx1_gart_probe (acpi_handle obj, u32 depth, void *context, void **ret)
 		status = acpi_get_object_info(handle, &info);
 		if (ACPI_SUCCESS(status)) {
 			/* TBD check _CID also */
-			info->hardware_id.string[sizeof(info->hardware_id.length)-1] = '\0';
-			match = (strcmp(info->hardware_id.string, "HWP0001") == 0);
+			if (info->valid & ACPI_VALID_HID)
+				match = !strcmp(info->hardware_id.string, "HWP0001");
+			else
+				match = 0;
 			kfree(info);
 			if (match) {
 				status = hp_acpi_csr_space(handle, &sba_hpa, &length);
drivers/pci/hotplug/acpiphp_ibm.c +0 -1
index a9d926b..e7be66d 100644
@@ -406,7 +406,6 @@ static acpi_status __init ibm_find_acpi_device(acpi_handle handle,
 			__func__, status);
 		return retval;
 	}
-	info->hardware_id.string[sizeof(info->hardware_id.length) - 1] = '\0';
 
 	if (info->current_status && (info->valid & ACPI_VALID_HID) &&
 			(!strcmp(info->hardware_id.string, IBM_HARDWARE_ID1) ||