[PATCH] range checking for sleep states sent to /proc/acpi/sleep
Linux Kernel Mailing List <[email protected]> Wed, 21 Jun 2006 16:59:03 GMT
| Newsgroups | gmane.linux.kernel.commits.2-4 |
|---|---|
| Message-ID | <[email protected]> |
commit 27cd4ebe6d1443a74234f05f87b91b2b2f8878a1 tree 43427534e80012bc9b32ce432756844ec2cc8f45 parent 02622aeaa107a575d5be329299ab48daba52afbb author Willy Tarreau <[email protected]> Wed, 21 Jun 2006 00:42:43 +0200 committer Marcelo Tosatti <[email protected]> Wed, 21 Jun 2006 16:40:43 -0300 [PATCH] range checking for sleep states sent to /proc/acpi/sleep A range checking is missing in acpi_system_write_sleep() in kernel 2.4, and writing a large integer value to /proc/acpi/sleep will cause an oops. I could reproduce one this way : # echo 0x800000 >/proc/acpi/sleep Fix extracted from the PaX patch. drivers/acpi/system.c | 2 +- 1 files changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/system.c b/drivers/acpi/system.c index a1e018c..26f7b68 100644 --- a/drivers/acpi/system.c +++ b/drivers/acpi/system.c @@ -748,7 +748,7 @@ acpi_system_write_sleep ( state = simple_strtoul(state_string, NULL, 0); - if (!system->states[state]) + if (state >= ACPI_S_STATE_COUNT || !system->states[state]) return_VALUE(-ENODEV); /*