Unverified Commit bd281fec authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12069 platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wupeng Ma <mawupeng1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/KCCQ3PXBQP25EAD5433OFIAQIVD3XEGA/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAUA6B 
 
Link:https://gitee.com/openeuler/kernel/pulls/12069

 

Reviewed-by: default avatarKefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents d9c9279f 0c283fec

drivers/platform/x86/panasonic-laptop.c

+21 −4
Original line number Diff line number Diff line
@@ -429,6 +429,18 @@ static DEVICE_ATTR(lcdtype, S_IRUGO, show_lcdtype, NULL); 
static DEVICE_ATTR(mute, S_IRUGO, show_mute, NULL);

static DEVICE_ATTR(sticky_key, S_IRUGO | S_IWUSR, show_sticky, set_sticky);



static umode_t pcc_sysfs_is_visible(struct kobject *kobj, struct attribute *attr, int idx)

{

	struct device *dev = kobj_to_dev(kobj);

	struct acpi_device *acpi = to_acpi_device(dev);

	struct pcc_acpi *pcc = acpi_driver_data(acpi);



	if (attr == &dev_attr_mute.attr)

		return (pcc->num_sifr > SINF_MUTE) ? attr->mode : 0;



	return attr->mode;

}



static struct attribute *pcc_sysfs_entries[] = {

	&dev_attr_numbatt.attr,

	&dev_attr_lcdtype.attr,
@@ -440,6 +452,7 @@ static struct attribute *pcc_sysfs_entries[] = { 
static const struct attribute_group pcc_attr_group = {

	.name		= NULL,		/* put in device directory */

	.attrs		= pcc_sysfs_entries,

	.is_visible	= pcc_sysfs_is_visible,

};
@@ -559,8 +572,12 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) 


	num_sifr = acpi_pcc_get_sqty(device);



	if (num_sifr < 0 || num_sifr > 255) {

		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "num_sifr out of range"));

	/*

	 * pcc->sinf is expected to at least have the AC+DC brightness entries.

	 * Accesses to higher SINF entries are checked against num_sifr.

	 */

	if (num_sifr <= SINF_DC_CUR_BRIGHT || num_sifr > 255) {

		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "num_sifr %d out of range %d - 255\n", num_sifr, SINF_DC_CUR_BRIGHT + 1));

		return -ENODEV;

	}