diff options
| author |   Bob Moore <robert.moore@intel.com> | 2008-08-04 11:13:01 +0800 |
|---|---|---|
| committer |   Andi Kleen <ak@linux.intel.com> | 2008-08-15 02:12:16 +0200 |
| commit | 3c7db22a194d3b53584047425af82b4e1e03d9f7 (patch) | |
| tree | 96462093e2826ca81641ccef7ae5718ce2b9c9bb /drivers/acpi/utilities | |
| parent | ACPICA: Fix possible memory leak in Unload() operator (diff) | |
| download | linux-dev-3c7db22a194d3b53584047425af82b4e1e03d9f7.tar.xz linux-dev-3c7db22a194d3b53584047425af82b4e1e03d9f7.zip | |
ACPICA: Additional error checking for pathname utilities
Add error check after all calls to acpi_ns_get_pathname_length.
Add status return from acpi_ns_build_external_path and check after
all calls. Add parameter validation to acpi_ut_initialize_buffer.
Reported by and initial patch by Ingo Molnar.
http://lkml.org/lkml/2008/7/21/176
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Diffstat (limited to 'drivers/acpi/utilities')
| -rw-r--r-- | drivers/acpi/utilities/utalloc.c | 8 | ||||
| -rw-r--r-- | drivers/acpi/utilities/utobject.c | 13 |
2 files changed, 14 insertions, 7 deletions
diff --git a/drivers/acpi/utilities/utalloc.c b/drivers/acpi/utilities/utalloc.c index e7bf34a7b1d2..7dcb67e0b215 100644 --- a/drivers/acpi/utilities/utalloc.c +++ b/drivers/acpi/utilities/utalloc.c @@ -242,10 +242,12 @@ acpi_ut_initialize_buffer(struct acpi_buffer * buffer, { acpi_status status = AE_OK; - if (!required_length) { - WARN_ON(1); - return AE_ERROR; + /* Parameter validation */ + + if (!buffer || !required_length) { + return (AE_BAD_PARAMETER); } + switch (buffer->length) { case ACPI_NO_BUFFER: diff --git a/drivers/acpi/utilities/utobject.c b/drivers/acpi/utilities/utobject.c index e25484495e65..916eff399eb3 100644 --- a/drivers/acpi/utilities/utobject.c +++ b/drivers/acpi/utilities/utobject.c @@ -425,6 +425,7 @@ acpi_ut_get_simple_object_size(union acpi_operand_object *internal_object, acpi_size * obj_length) { acpi_size length; + acpi_size size; acpi_status status = AE_OK; ACPI_FUNCTION_TRACE_PTR(ut_get_simple_object_size, internal_object); @@ -484,10 +485,14 @@ acpi_ut_get_simple_object_size(union acpi_operand_object *internal_object, * Get the actual length of the full pathname to this object. * The reference will be converted to the pathname to the object */ - length += - ACPI_ROUND_UP_TO_NATIVE_WORD - (acpi_ns_get_pathname_length - (internal_object->reference.node)); + size = + acpi_ns_get_pathname_length(internal_object-> + reference.node); + if (!size) { + return_ACPI_STATUS(AE_BAD_PARAMETER); + } + + length += ACPI_ROUND_UP_TO_NATIVE_WORD(size); break; default: |