Skip to contentSkip to conversation

acpi: check return value of acpi_os_map_memory

PATCH In review RUC_SoftSec 2 participants 2 messages Oct 28, 2013 ACPI

lore
Share & tools
lore

RUC_SoftSec

author
#0 lore raw

PATCH 1/1 acpi: check return value of acpi_os_map_memory

Function acpi_os_map_memory() may return a NULL pointer, it should be validated non-NULL before used. This bug is found by a static tool developed by RUC_SoftSec, supported by China.X.Orion.

Signed-off-by RUC_SoftSec <[email protected]>
---
 drivers/acpi/osl.c |    2 ++
 1 file changed, 2 insertions(+)
drivers/acpi/osl.c +2 -0
index e5f416c..bf8f93f 100644
@@ -717,6 +717,8 @@ acpi_os_physical_table_override(struct acpi_table_header *existing_table,
 
 		table = acpi_os_map_memory(acpi_tables_addr + table_offset,
 					   ACPI_HEADER_SIZE);
+		if (table == NULL)
+			return AE_OK;
 
 		if (table_offset + table->length > all_tables_size) {
 			acpi_os_unmap_memory(table, ACPI_HEADER_SIZE);
Signature · 1 line
1.7.9.5
#1 lore raw
Quoted 13 lines · RUC_SoftSec

Function acpi_os_map_memory() may return a NULL pointer, it should be validated non-NULL before used. This bug is found by a static tool developed by RUC_SoftSec, supported by China.X.Orion.

Signed-off-by RUC_SoftSec <[email protected]>
---
 drivers/acpi/osl.c |    2 ++
 1 file changed, 2 insertions(+)
drivers/acpi/osl.c +0 -0
index e5f416c..bf8f93f 100644

drivers/acpi/osl.c acpi_os_physical_table_override(struct acpi_table_header *existing_table, · line 720

Quoted 4 lines
drivers/acpi/osl.c +1 -0
@@ -717,6 +717,8 @@ acpi_os_physical_table_override(struct acpi_table_header *existing_table,
 
 		table = acpi_os_map_memory(acpi_tables_addr + table_offset,
 					   ACPI_HEADER_SIZE);
+		if (table == NULL)

"if (!table)" perhaps?

drivers/acpi/osl.c acpi_os_physical_table_override(struct acpi_table_header *existing_table, · line 721

Quoted 1 line
drivers/acpi/osl.c +1 -0
+			return AE_OK;

And why is it a good idea to return success then?

drivers/acpi/osl.c acpi_os_physical_table_override(struct acpi_table_header *existing_table,

Quoted 4 lines
drivers/acpi/osl.c +0 -0
 		if (table_offset + table->length > all_tables_size) {
 			acpi_os_unmap_memory(table, ACPI_HEADER_SIZE);

Thanks!

Signature · 2 lines
I speak only for myself.
Rafael J. Wysocki, Intel Open Source Technology Center.