Commit f4e087c6 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'acpi-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm 

Pull ACPI fixes from Rafael Wysocki:
 "These address a device ID bounds check error in the device enumeration
  code and fix a mistake in the documentation.

  Specifics:

   - Harden the ACPI device enumeration code against device ID length
     overflows to address a Linux VM cash on Hyper-V (Dexuan Cui).

   - Fix a mistake in the documentation of error type values for PCIe
     errors (Qiuxu Zhuo)"

* tag 'acpi-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  Documentation: ACPI: EINJ: Fix error type values for PCIe errors
  ACPI: scan: Harden acpi_device_add() against device ID overflows
parents dcda487c 179892ad

Documentation/firmware-guide/acpi/apei/einj.rst

+2 −2
Original line number Diff line number Diff line
@@ -50,8 +50,8 @@ The following files belong to it: 
  0x00000010        Memory Uncorrectable non-fatal

  0x00000020        Memory Uncorrectable fatal

  0x00000040        PCI Express Correctable

  0x00000080        PCI Express Uncorrectable fatal

  0x00000100        PCI Express Uncorrectable non-fatal

  0x00000080        PCI Express Uncorrectable non-fatal

  0x00000100        PCI Express Uncorrectable fatal

  0x00000200        Platform Correctable

  0x00000400        Platform Uncorrectable non-fatal

  0x00000800        Platform Uncorrectable fatal

drivers/acpi/internal.h

+1 −1
Original line number Diff line number Diff line
@@ -97,7 +97,7 @@ void acpi_scan_table_handler(u32 event, void *table, void *context); 
extern struct list_head acpi_bus_id_list;



struct acpi_device_bus_id {

	char bus_id[15];

	const char *bus_id;

	unsigned int instance_no;

	struct list_head node;

};

drivers/acpi/scan.c

+14 −1
Original line number Diff line number Diff line
@@ -486,6 +486,7 @@ static void acpi_device_del(struct acpi_device *device) 
				acpi_device_bus_id->instance_no--;

			else {

				list_del(&acpi_device_bus_id->node);

				kfree_const(acpi_device_bus_id->bus_id);

				kfree(acpi_device_bus_id);

			}

			break;
@@ -674,7 +675,14 @@ int acpi_device_add(struct acpi_device *device, 
	}

	if (!found) {

		acpi_device_bus_id = new_bus_id;

		strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device));

		acpi_device_bus_id->bus_id =

			kstrdup_const(acpi_device_hid(device), GFP_KERNEL);

		if (!acpi_device_bus_id->bus_id) {

			pr_err(PREFIX "Memory allocation error for bus id\n");

			result = -ENOMEM;

			goto err_free_new_bus_id;

		}



		acpi_device_bus_id->instance_no = 0;

		list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list);

	}
@@ -709,6 +717,11 @@ int acpi_device_add(struct acpi_device *device, 
	if (device->parent)

		list_del(&device->node);

	list_del(&device->wakeup_list);



 err_free_new_bus_id:

	if (!found)

		kfree(new_bus_id);



	mutex_unlock(&acpi_device_lock);



 err_detach: