kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

thinkpad_acpi: buffer overflow in fan_get_status()

Browse source 
The acpi_evalf() function modifies four bytes of data but in
fan_get_status() we pass a pointer to u8.  I have modified the
function to use type checking now.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
This commit is contained in:
Dan Carpenter 2012-09-01 12:54:07 -07:00 committed by Matthew Garrett
parent f661848b74
commit eceeb43712
1 changed files with 7 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/platform/x86/thinkpad_acpi.c
View file

@ -545,7 +545,7 @@ TPACPI_HANDLE(hkey, ec, "\\_SB.HKEY", /* 600e/x, 770e, 770x */
*/
static int acpi_evalf(acpi_handle handle,
void *res, char *method, char *fmt, ...)
int *res, char *method, char *fmt, ...)
{
char *fmt0 = fmt;
struct acpi_object_list params;
@ -606,7 +606,7 @@ static int acpi_evalf(acpi_handle handle,
success = (status == AE_OK &&
out_obj.type == ACPI_TYPE_INTEGER);
if (success && res)
*(int *)res = out_obj.integer.value;
*res = out_obj.integer.value;
break;
case 'v': /* void */
success = status == AE_OK;
@ -7386,17 +7386,18 @@ static int fan_get_status(u8 *status)
* Add TPACPI_FAN_RD_ACPI_FANS ? */
switch (fan_status_access_mode) {
case TPACPI_FAN_RD_ACPI_GFAN:
case TPACPI_FAN_RD_ACPI_GFAN: {
/* 570, 600e/x, 770e, 770x */
int res;
if (unlikely(!acpi_evalf(gfan_handle, &s, NULL, "d")))
if (unlikely(!acpi_evalf(gfan_handle, &res, NULL, "d")))
return -EIO;
if (likely(status))
*status = s & 0x07;
*status = res & 0x07;
break;
}
case TPACPI_FAN_RD_TPEC:
/* all except 570, 600e/x, 770e, 770x */
if (unlikely(!acpi_ec_read(fan_status_offset, &s)))