Commit 3c21441e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'acpi-6.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm 

Pull ACPI fix from Rafael Wysocki:
 "Fix ACPI PPTT parsing code to address a regression introduced recently
  and add more sanity checking of data supplied by the platform firmware
  to avoid using invalid data (Jeremy Linton)"

* tag 'acpi-6.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: PPTT: Fix processor subtable walk
parents bd8bb9f3 adfab6b3

drivers/acpi/pptt.c

+8 −3
Original line number Diff line number Diff line
@@ -231,16 +231,18 @@ static int acpi_pptt_leaf_node(struct acpi_table_header *table_hdr, 
			     sizeof(struct acpi_table_pptt));

	proc_sz = sizeof(struct acpi_pptt_processor);



	while ((unsigned long)entry + proc_sz < table_end) {

	/* ignore subtable types that are smaller than a processor node */

	while ((unsigned long)entry + proc_sz <= table_end) {

		cpu_node = (struct acpi_pptt_processor *)entry;



		if (entry->type == ACPI_PPTT_TYPE_PROCESSOR &&

		    cpu_node->parent == node_entry)

			return 0;

		if (entry->length == 0)

			return 0;



		entry = ACPI_ADD_PTR(struct acpi_subtable_header, entry,

				     entry->length);



	}

	return 1;

}
@@ -273,15 +275,18 @@ static struct acpi_pptt_processor *acpi_find_processor_node(struct acpi_table_he 
	proc_sz = sizeof(struct acpi_pptt_processor);



	/* find the processor structure associated with this cpuid */

	while ((unsigned long)entry + proc_sz < table_end) {

	while ((unsigned long)entry + proc_sz <= table_end) {

		cpu_node = (struct acpi_pptt_processor *)entry;



		if (entry->length == 0) {

			pr_warn("Invalid zero length subtable\n");

			break;

		}

		/* entry->length may not equal proc_sz, revalidate the processor structure length */

		if (entry->type == ACPI_PPTT_TYPE_PROCESSOR &&

		    acpi_cpu_id == cpu_node->acpi_processor_id &&

		    (unsigned long)entry + entry->length <= table_end &&

		    entry->length == proc_sz + cpu_node->number_of_priv_resources * sizeof(u32) &&

		     acpi_pptt_leaf_node(table_hdr, cpu_node)) {

			return (struct acpi_pptt_processor *)entry;

		}