leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
131be26750
linux/drivers/acpi
History
Dexuan Cui a58015d638 ACPI: scan: Harden acpi_device_add() against device ID overflows 
Linux VM on Hyper-V crashes with the latest mainline:

[    4.069624] detected buffer overflow in strcpy
[    4.077733] kernel BUG at lib/string.c:1149!
..
[    4.085819] RIP: 0010:fortify_panic+0xf/0x11
...
[    4.085819] Call Trace:
[    4.085819]  acpi_device_add.cold.15+0xf2/0xfb
[    4.085819]  acpi_add_single_object+0x2a6/0x690
[    4.085819]  acpi_bus_check_add+0xc6/0x280
[    4.085819]  acpi_ns_walk_namespace+0xda/0x1aa
[    4.085819]  acpi_walk_namespace+0x9a/0xc2
[    4.085819]  acpi_bus_scan+0x78/0x90
[    4.085819]  acpi_scan_init+0xfa/0x248
[    4.085819]  acpi_init+0x2c1/0x321
[    4.085819]  do_one_initcall+0x44/0x1d0
[    4.085819]  kernel_init_freeable+0x1ab/0x1f4

This is because of the recent buffer overflow detection in the
commit 6a39e62abb ("lib: string.h: detect intra-object overflow in
fortified string functions")

Here acpi_device_bus_id->bus_id can only hold 14 characters, while the
the acpi_device_hid(device) returns a 22-char string
"HYPER_V_GEN_COUNTER_V1".

Per ACPI Spec v6.2, Section 6.1.5 _HID (Hardware ID), if the ID is a
string, it must be of the form AAA#### or NNNN####, i.e. 7 chars or 8
chars.

The field bus_id in struct acpi_device_bus_id was originally defined as
char bus_id[9], and later was enlarged to char bus_id[15] in 2007 in the
commit bb0958544f ("ACPI: use more understandable bus_id for ACPI
devices")

Fix the issue by changing the field bus_id to const char *, and use
kstrdup_const() to initialize it.

Signed-off-by: Dexuan Cui <decui@microsoft.com>
Tested-By: Jethro Beekman <jethro@fortanix.com>
[ rjw: Subject change, whitespace adjustment ]
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2021-01-11 20:45:31 +01:00
..
acpica ACPICA: Interpreter: fix memory leak by using existing buffer 2020-12-01 18:13:30 +01:00
apei Merge ACPI APEI material for v5.11. 2020-11-23 12:50:17 +01:00
arm64 Merge remote-tracking branch 'arm64/for-next/fixes' into for-next/core 2020-12-09 18:04:55 +00:00
dptf ACPI: DPTF: Support Alder Lake 2020-11-10 18:52:51 +01:00
nfit ACPI: NFIT: Fix input validation of bus-family 2020-11-23 17:43:53 -08:00
numa ACPI updates for 5.10-rc1 2020-10-14 11:42:04 -07:00
pmic ACPI / PMIC: Move TPS68470 OpRegion driver to drivers/acpi/pmic/ 2020-09-15 19:40:59 +02:00
x86 ACPI: PM: s2idle: Drop unused local variables and related code 2021-01-07 17:41:28 +01:00
ac.c Merge branches 'acpi-mm', 'acpi-tables', 'acpi-apei' and 'acpi-misc' 2020-08-03 13:14:42 +02:00
acpi_adxl.c
acpi_amba.c
acpi_apd.c ACPI: APD: Clean up header file include statements 2020-09-25 12:48:11 +02:00
acpi_cmos_rtc.c ACPI: cmos_rtc: Remove leftover ACPI_MODULE_NAME() 2020-09-25 18:25:51 +02:00
acpi_configfs.c ACPI: configfs: Add missing config_item_put() to fix refcount leak 2020-09-25 18:08:39 +02:00
acpi_dbg.c ACPI: debug: Remove the not used function 2020-11-17 18:12:34 +01:00
acpi_extlog.c ACPI / extlog: Check for RDMSR failure 2020-10-02 19:01:55 +02:00
acpi_ipmi.c
acpi_lpat.c
acpi_lpit.c ACPI: LPIT: Put the low power idle table after using it 2020-05-09 11:29:16 +02:00
acpi_lpss.c drm next for 5.10-rc1 2020-10-15 10:46:16 -07:00
acpi_memhotplug.c mm/memory_hotplug: prepare passing flags to add_memory() and friends 2020-10-16 11:11:18 -07:00
acpi_pad.c This tree adds the sched_set_fifo*() encapsulation APIs to remove 2020-08-06 11:55:43 -07:00
acpi_platform.c ACPI: platform: Remove ACPI_MODULE_NAME() 2020-09-25 18:25:51 +02:00
acpi_pnp.c ACPI: PNP: compare the string length in the matching_id() 2020-12-15 19:30:49 +01:00
acpi_processor.c ACPI: processor: remove comment regarding string _UID support 2020-10-16 18:11:27 +02:00
acpi_tad.c PM: sleep: core: Rename DPM_FLAG_LEAVE_SUSPENDED 2020-04-24 21:34:22 +02:00
acpi_video.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
acpi_watchdog.c ACPI: watchdog: Replace open coded variant of resource_union() 2020-11-17 18:06:29 +01:00
battery.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
bgrt.c
blacklist.c ACPI: blacklist: fix clang warning for unused DMI table 2019-07-11 22:45:00 +02:00
bus.c USB/PHY/Thunderbolt driver patches for 5.10-rc1 2020-10-15 09:51:18 -07:00
button.c ACPI: button: Add DMI quirk for Medion Akoya E2228T 2020-11-09 19:29:41 +01:00
container.c ACPI: container: Remove leftover ACPICA debug functionality 2020-09-25 18:25:51 +02:00
cppc_acpi.c Merge branch 'pm-cpufreq' 2020-12-22 17:59:11 +01:00
custom_method.c ACPI: custom_method: Remove dead ACPICA debug code 2020-09-25 18:25:51 +02:00
debugfs.c ACPI: debugfs: Remove dead ACPICA debug code 2020-09-25 18:25:51 +02:00
device_pm.c PM: ACPI: Refresh wakeup device power configuration every time 2020-12-07 13:45:47 +01:00
device_sysfs.c
dock.c ACPI: dock: fix enum-conversion warning 2020-10-27 19:30:27 +01:00
ec_sys.c
ec.c ACPI: EC: Clean up status flags checks in advance_transaction() 2020-11-23 20:01:01 +01:00
event.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
evged.c ACPI: GED: fix -Wformat 2020-11-09 19:25:20 +01:00
fan.c ACPI: fan: Initialize performance state sysfs attribute 2020-11-16 15:18:38 +01:00
glue.c
hed.c
internal.h ACPI: scan: Harden acpi_device_add() against device ID overflows 2021-01-11 20:45:31 +01:00
ioapic.c
irq.c Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2019-07-08 11:01:13 -07:00
Kconfig ACPI: Update Kconfig help text for items that are no longer modular 2021-01-07 17:48:37 +01:00
Makefile ACPI: PM: s2idle: Move x86-specific code to the x86 directory 2020-12-17 20:30:02 +01:00
nvs.c
osi.c ACPI: OSI: Shoot duplicate word 2019-11-13 11:12:08 +01:00
osl.c ACPI: OSL: Make ACPICA use logical addresses of GPE blocks 2020-09-11 16:45:00 +02:00
pci_irq.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
pci_link.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
pci_mcfg.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
pci_root.c PCI/ACPI: Replace open coded variant of resource_union() 2020-11-17 18:06:28 +01:00
pci_slot.c ACPI: PCI: Remove unused ACPICA debug code 2020-09-25 18:25:51 +02:00
power.c Merge branches 'acpica' and 'acpi-scan' 2020-12-15 15:29:30 +01:00
pptt.c ACPI: PPTT: Consistently use unsigned int as parameter type 2020-01-07 11:46:36 +01:00
proc.c ACPI: proc: Remove dead ACPICA debug code 2020-09-25 18:25:51 +02:00
processor_core.c ACPI: processor: Remove dead ACPICA debug code 2020-09-25 18:25:51 +02:00
processor_driver.c cpufreq: Use per-policy frequency QoS 2019-10-21 02:05:21 +02:00
processor_idle.c ACPI: processor: Remove the duplicated ACPI_PROCESSOR_CLASS macro 2020-11-17 18:12:34 +01:00
processor_pdc.c
processor_perflib.c More power management updates for 5.11-rc1 2020-12-22 14:12:10 -08:00
processor_thermal.c ACPI: processor: Remove the duplicated ACPI_PROCESSOR_CLASS macro 2020-11-17 18:12:34 +01:00
processor_throttling.c ACPI: processor: Remove the duplicated ACPI_PROCESSOR_CLASS macro 2020-11-17 18:12:34 +01:00
property.c driver core: Add fwnode_init() 2020-12-09 19:10:20 +01:00
reboot.c ACPI: reboot: Avoid racing after writing to ACPI RESET_REG 2020-10-16 18:04:52 +02:00
resource.c ACPI updates for 5.11-rc1 2020-12-15 16:39:06 -08:00
sbs.c ACPI: SBS: Simplify the code using module_acpi_driver() 2020-11-17 18:12:34 +01:00
sbshc.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
sbshc.h ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
scan.c ACPI: scan: Harden acpi_device_add() against device ID overflows 2021-01-11 20:45:31 +01:00
sleep.c ACPI: PM: s2idle: Move x86-specific code to the x86 directory 2020-12-17 20:30:02 +01:00
sleep.h ACPI: PM: s2idle: Move x86-specific code to the x86 directory 2020-12-17 20:30:02 +01:00
spcr.c ACPI: Use fallthrough pseudo-keyword 2020-07-09 14:09:28 +02:00
sysfs.c Merge back sysfs-related ACPI material for v5.9. 2020-06-29 13:49:49 +02:00
tables.c ACPI: tables: Remove the duplicated checks for acpi_parse_entries_array() 2020-07-27 15:19:12 +02:00
thermal.c acpi: thermal: Don't call thermal_zone_device_is_enabled() 2020-07-07 01:26:06 +02:00
tiny-power-button.c ACPI: tiny-power-button: Simplify the code using module_acpi_driver() 2020-11-17 18:12:34 +01:00
utils.c ACPI: utils: remove unreachable breaks 2020-10-22 18:58:26 +02:00
video_detect.c ACPI: video: Add DMI quirk for GIGABYTE GB-BXBT-2807 2020-12-07 14:01:22 +01:00
wakeup.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00