aboutsummaryrefslogtreecommitdiff
path: root/drivers/acpi/acpica/utcopy.c
AgeCommit message (Collapse)Author
2022-12-31ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()Li Zetao
[ Upstream commit 470188b09e92d83c5a997f25f0e8fb8cd2bc3469 ] There is an use-after-free reported by KASAN: BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82 Read of size 1 at addr ffff888112afc460 by task modprobe/2111 CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), Call Trace: <TASK> kasan_report+0xae/0xe0 acpi_ut_remove_reference+0x3b/0x82 acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5 acpi_ds_store_object_to_local+0x15d/0x3a0 acpi_ex_store+0x78d/0x7fd acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b acpi_ps_parse_aml+0x217/0x8d5 ... </TASK> The root cause of the problem is that the acpi_operand_object is freed when acpi_ut_walk_package_tree() fails in acpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in acpi_ut_copy_iobject_to_iobject(). The problem was introduced by "8aa5e56eeb61" commit, this commit is to fix memory leak in acpi_ut_copy_iobject_to_iobject(), repeatedly adding remove operation, lead to "acpi_operand_object" used after free. Fix it by removing acpi_ut_remove_reference() in acpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage() is called to copy an internal package object into another internal package object, when it fails, the memory of acpi_operand_object should be freed by the caller. Fixes: 8aa5e56eeb61 ("ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject") Signed-off-by: Li Zetao <lizetao1@huawei.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-13ACPICA: Update copyright notices to the year 2022Bob Moore
ACPICA commit 738d7b0726e6c0458ef93c0a01c0377490888d1e Affects all source modules and utility signons. Link: https://github.com/acpica/acpica/commit/738d7b07 Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2021-01-22ACPICA: Updated all copyrights to 2021Bob Moore
This affects all ACPICA source code modules. ACPICA commit c570953c914437e621dd5f160f26ddf352e0d2f4 Link: https://github.com/acpica/acpica/commit/c570953c Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Erik Kaneda <erik.kaneda@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2020-01-13ACPICA: All acpica: Update copyrights to 2020 Including tool signons.Bob Moore
ACPICA commit 8b9c69d0984067051ffbe8526f871448ead6a26b Link: https://github.com/acpica/acpica/commit/8b9c69d0 Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Erik Kaneda <erik.kaneda@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2019-01-15ACPICA: All acpica: Update copyrights to 2019Bob Moore
ACPICA commit 62f4f98e941d86e41969bf2ab5a93b8dc94dc49e The update includes userspace tool signons. Link: https://github.com/acpica/acpica/commit/62f4f98e Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Erik Schmauss <erik.schmauss@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2018-03-18ACPICA: adding SPDX headersErik Schmauss
Signed-off-by: Erik Schmauss <erik.schmauss@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2018-02-06ACPICA: All acpica: Update copyrights to 2018Bob Moore
including tool signons. Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Erik Schmauss <erik.schmauss@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2017-02-09ACPICA: Source tree: Update copyright notices to 2017Bob Moore
ACPICA commit 16577e5265923f4999b4d2c0addb2343b18135e1 Affects all files. Link: https://github.com/acpica/acpica/commit/16577e52 Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-05-05ACPICA: Divergence: remove unwanted spaces for typedefLv Zheng
ACPICA commit b2294cae776f5a66a7697414b21949d307e6856f This patch removes unwanted spaces for typedef. This solution doesn't cover function types. Note that the linuxize result of this commit is very giant and should have many conflicts against the current Linux upstream. Thus it is required to modify the linuxize result of this commit and the commits around it manually in order to have them merged to the Linux upstream. Since this is very costy, we should do this only once, and if we can't ensure to do this only once, we need to revert the Linux code to the wrong indentation result before merging the linuxize result of this commit. Lv Zheng. Link: https://github.com/acpica/acpica/commit/b2294cae Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-01-15ACPICA: Additional 2016 copyright changesBob Moore
All tool/utility signons. Dual-license module header. Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-01-01ACPICA: Core: Major update for code formatting, no functional changesBob Moore
ACPICA commit dfa394471f6c01b2ee9433dbc143ec70cb9bca72 Mostly indentation inconsistencies across the code. Split some long lines, etc. Link: https://github.com/acpica/acpica/commit/dfa39447 Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2015-07-01ACPICA: De-macroize calls to standard C library functionsBob Moore
ACPICA commit 3b1026e0bdd3c32eb6d5d313f3ba0b1fee7597b4 ACPICA commit 00f0dc83f5cfca53b27a3213ae0d7719b88c2d6b ACPICA commit 47d22a738d0e19fd241ffe4e3e9d4e198e4afc69 Across all of ACPICA. Replace C library macros such as ACPI_STRLEN with the standard names such as strlen. The original purpose for these macros is long since obsolete. Also cast various invocations as necessary. Bob Moore, Jung-uk Kim, Lv Zheng. Link: https://github.com/acpica/acpica/commit/3b1026e0 Link: https://github.com/acpica/acpica/commit/00f0dc83 Link: https://github.com/acpica/acpica/commit/47d22a73 Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Jung-uk Kim <jkim@FreeBSD.org> Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2015-02-05ACPICA: Update Copyright headers to 2015David E. Box
ACPICA commit 8990e73ab2aa15d6a0068b860ab54feff25bee36 Link: https://github.com/acpica/acpica/commit/8990e73a Signed-off-by: David E. Box <david.e.box@linux.intel.com> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-07-08ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobjectDavid E. Box
Adds return status check on copy routines to delete the allocated destination object if either copy fails. Reported by Colin Ian King on bugs.acpica.org, Bug 1087. The last applicable commit: Commit: 3371c19c294a4cb3649aa4e84606be8a1d999e61 Subject: ACPICA: Remove ACPI_GET_OBJECT_TYPE macro Link: https://bugs.acpica.org/show_bug.cgi?id=1087 Reported-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: David E. Box <david.e.box@linux.intel.com> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lv Zheng <lv.zheng@intel.com> Cc: 3.9+ <stable@vger.kernel.org> # 3.9+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-02-11ACPICA: Correctly support references in the union acpi_object.Bob Moore
This change fixes the support to allow references (namespace nodes) to be passed as arguments to control methods via the evaluate object interface. This is probably most useful for testing purposes, however. Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-02-11ACPICA: Update ACPICA copyrights to 2014.Bob Moore
Update ACPICA copyrights to 2014. Includes all source headers and signons for the various tools. Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-10-31ACPICA: Linuxize: Change indentation of C labels.Lv Zheng
It is reported by kernel build test systems that all ACPICA source files in the kernel tree have incorrect label indentation. This patch changes default indent option used in the release process to fix this bug. Lv Zheng. Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-06-16ACPICA: Standardize all switch() blocksChao Guan
After many years, different formatting for switch() has crept in. This change makes every switch block identical. Chao Guan. ACPICA bugzilla 997. References: https://bugs.acpica.org/show_bug.cgi?id=997 Signed-off-by: Chao Guan <chao.guan@intel.com> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-01-25ACPICA: Update ACPICA copyrights to 2013Bob Moore
Includes all source headers and signons for the various tools. Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2013-01-10ACPICA: Cleanup coding style to reduce differences between Linux and ACPICA.Lv Zheng
This is a cosmetic patch only. Comparison of the resulting binary showed only line number differences. This patch does not affect the generation of the Linux binary. This patch decreases 314 lines of 20121018 divergence.diff. ACPICA core uses ()'s on return statements. This is a known and committed differences from Linux standard coding style. This patch cleans up the Linux side ACPICA code to use this codying style in order to reduce the source code differences between Linux and ACPICA. Signed-off-by: Lv Zheng <lv.zheng@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2012-07-17ACPICA: AcpiSrc: Fix some translation issues for Linux conversionBob Moore
Fixes issues like this: i_aSL -> iASL 00-7_f -> 00-7F local_fADT -> local_FADT execute_oSI -> execute_OSI Also, in function headers, the parameters are now translated to lower case (with underscores if necessary.) Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lin Ming <ming.m.lin@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
2012-01-17ACPICA: Update all copyrights to 2012Bob Moore
Update all copyrights to 2012. Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lin Ming <ming.m.lin@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
2011-01-18ACPICA: Update all ACPICA copyrights and signons to 2011Bob Moore
Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lin Ming <ming.m.lin@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
2010-05-06ACPICA: Prevent possible allocation overrun during object copyLin Ming
Original code did not handle the case where the object to be copied was a namespace node. Signed-off-by: Lin Ming <ming.m.lin@intel.com> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
2010-01-22ACPICA: Update all ACPICA copyrights and signons to 2010Bob Moore
Add 2010 copyright to all module headers and signons, including the Linux header. This affects virtually every file in the ACPICA core subsystem, iASL compiler, and all utilities. Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lin Ming <ming.m.lin@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
2009-12-15ACPICA: Update function headers, no functional changeBob Moore
Fixed a few errors with the headers in utcopy.c Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lin Ming <ming.m.lin@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
2009-05-27ACPICA: Change behavior of object copy for mutex/event objectsBob Moore
When copying these internal objects, cannot simply copy the underlying OS object. A new OS object must be created. Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lin Ming <ming.m.lin@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
2009-03-26ACPICA: Formatting update - no functional changesBob Moore
Split some long lines. Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lin Ming <ming.m.lin@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
2009-03-26ACPICA: Remove ACPI_GET_OBJECT_TYPE macroBob Moore
Remove all instances of this obsolete macro, since it is now a simple reference to ->common.type. There were about 150 invocations of the macro across 41 files. ACPICA BZ 755. http://www.acpica.org/bugzilla/show_bug.cgi?id=755 Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Lin Ming <ming.m.lin@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
2009-01-09ACPICA: hide private headersLen Brown
Signed-off-by: Len Brown <len.brown@intel.com>
2009-01-09ACPICA: create acpica/ directoryLen Brown
also, delete sleep/ and delete ACPI_CFLAGS from Makefile Signed-off-by: Len Brown <len.brown@intel.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-07 17:25:59 +0000