| From 61388f9e5d93053cf399a356414f31f9b4814c6d Mon Sep 17 00:00:00 2001 |
| From: Bob Moore <robert.moore@intel.com> |
| Date: Wed, 8 May 2013 04:01:15 +0000 |
| Subject: ACPICA: Fix possible buffer overflow during a field unit read operation |
| |
| From: Bob Moore <robert.moore@intel.com> |
| |
| commit 61388f9e5d93053cf399a356414f31f9b4814c6d upstream. |
| |
| Can only happen under these conditions: 1) The DSDT version is 1, |
| meaning integers are 32-bits. 2) The field is between 33 and 64 |
| bits long. |
| |
| It applies cleanly back to ACPICA 20100806+ (Linux v2.6.37+). |
| |
| Signed-off-by: Bob Moore <robert.moore@intel.com> |
| Signed-off-by: Lv Zheng <lv.zheng@intel.com> |
| Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/acpi/acpica/exfldio.c | 14 +++++++++++++- |
| 1 file changed, 13 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/acpi/acpica/exfldio.c |
| +++ b/drivers/acpi/acpica/exfldio.c |
| @@ -720,7 +720,19 @@ acpi_ex_extract_from_field(union acpi_op |
| |
| if ((obj_desc->common_field.start_field_bit_offset == 0) && |
| (obj_desc->common_field.bit_length == access_bit_width)) { |
| - status = acpi_ex_field_datum_io(obj_desc, 0, buffer, ACPI_READ); |
| + if (buffer_length >= sizeof(u64)) { |
| + status = |
| + acpi_ex_field_datum_io(obj_desc, 0, buffer, |
| + ACPI_READ); |
| + } else { |
| + /* Use raw_datum (u64) to handle buffers < 64 bits */ |
| + |
| + status = |
| + acpi_ex_field_datum_io(obj_desc, 0, &raw_datum, |
| + ACPI_READ); |
| + ACPI_MEMCPY(buffer, &raw_datum, buffer_length); |
| + } |
| + |
| return_ACPI_STATUS(status); |
| } |
| |
