lkml.org 
[lkml]   [2018]   [May]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 127/185] xen/acpi: off by one in read_acpi_id()
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit c37a3c94775855567b90f91775b9691e10bd2806 ]

    If acpi_id is == nr_acpi_bits, then we access one element beyond the end
    of the acpi_psd[] array or we set one bit beyond the end of the bit map
    when we do __set_bit(acpi_id, acpi_id_present);

    Fixes: 59a568029181 ("xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
    Reviewed-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/xen/xen-acpi-processor.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    --- a/drivers/xen/xen-acpi-processor.c
    +++ b/drivers/xen/xen-acpi-processor.c
    @@ -362,9 +362,9 @@ read_acpi_id(acpi_handle handle, u32 lvl
    }
    /* There are more ACPI Processor objects than in x2APIC or MADT.
    * This can happen with incorrect ACPI SSDT declerations. */
    - if (acpi_id > nr_acpi_bits) {
    - pr_debug("We only have %u, trying to set %u\n",
    - nr_acpi_bits, acpi_id);
    + if (acpi_id >= nr_acpi_bits) {
    + pr_debug("max acpi id %u, trying to set %u\n",
    + nr_acpi_bits - 1, acpi_id);
    return AE_OK;
    }
    /* OK, There is a ACPI Processor object */

    \
     
     \ /
      Last update: 2018-05-28 18:23    [W:4.019 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site