Commit 35b73ceb authored by Bjorn Helgaas's avatar Bjorn Helgaas Committed by Linus Torvalds

[PATCH] ACPI: fix vendor resource length computation

acpi_rs_get_list_length() needs to account for all the vendor-defined data
bytes.  Failing to include these causes buffers to be sized too small,
which causes slab corruption when we later convert AML to resources and run
off the end of the buffer.

This causes slab corruption on machines that use ACPI vendor-defined
resources.  All HP ia64 machines do, and I'm told that some NEC machines
may as well.
Signed-off-by: default avatarBjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "Brown, Len" <len.brown@intel.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 636f13c1
...@@ -391,8 +391,7 @@ acpi_rs_get_list_length(u8 * aml_buffer, ...@@ -391,8 +391,7 @@ acpi_rs_get_list_length(u8 * aml_buffer,
* Ensure a 32-bit boundary for the structure * Ensure a 32-bit boundary for the structure
*/ */
extra_struct_bytes = extra_struct_bytes =
ACPI_ROUND_UP_to_32_bITS(resource_length) - ACPI_ROUND_UP_to_32_bITS(resource_length);
resource_length;
break; break;
case ACPI_RESOURCE_NAME_END_TAG: case ACPI_RESOURCE_NAME_END_TAG:
...@@ -408,8 +407,7 @@ acpi_rs_get_list_length(u8 * aml_buffer, ...@@ -408,8 +407,7 @@ acpi_rs_get_list_length(u8 * aml_buffer,
* Add vendor data and ensure a 32-bit boundary for the structure * Add vendor data and ensure a 32-bit boundary for the structure
*/ */
extra_struct_bytes = extra_struct_bytes =
ACPI_ROUND_UP_to_32_bITS(resource_length) - ACPI_ROUND_UP_to_32_bITS(resource_length);
resource_length;
break; break;
case ACPI_RESOURCE_NAME_ADDRESS32: case ACPI_RESOURCE_NAME_ADDRESS32:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment