diff options
| author | Mauro Carvalho Chehab <mchehab@redhat.com> | 2012-10-17 09:32:49 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2012-10-17 09:32:49 -0300 |
| commit | 214e2ca2b82d335935a861c253fe94c61ad77aad (patch) | |
| tree | eee42ff74d10470789d919b8499737ad0e919360 /drivers/acpi/tables.c | |
| parent | 1fdead8ad31d3aa833bc37739273fcde89ace93c (diff) | |
| parent | ddffeb8c4d0331609ef2581d84de4d763607bd37 (diff) | |
Merge tag 'v3.7-rc1' into staging/for_v3.8
Linux 3.7-rc1
* tag 'v3.7-rc1': (9579 commits)
Linux 3.7-rc1
x86, boot: Explicitly include autoconf.h for hostprogs
perf: Fix UAPI fallout
ARM: config: make sure that platforms are ordered by option string
ARM: config: sort select statements alphanumerically
UAPI: (Scripted) Disintegrate include/linux/byteorder
UAPI: (Scripted) Disintegrate include/linux
UAPI: Unexport linux/blk_types.h
UAPI: Unexport part of linux/ppp-comp.h
perf: Handle new rbtree implementation
procfs: don't need a PATH_MAX allocation to hold a string representation of an int
vfs: embed struct filename inside of names_cache allocation if possible
audit: make audit_inode take struct filename
vfs: make path_openat take a struct filename pointer
vfs: turn do_path_lookup into wrapper around struct filename variant
audit: allow audit code to satisfy getname requests from its names_list
vfs: define struct filename and have getname() return it
btrfs: Fix compilation with user namespace support enabled
userns: Fix posix_acl_file_xattr_userns gid conversion
userns: Properly print bluetooth socket uids
...
Diffstat (limited to 'drivers/acpi/tables.c')
| -rw-r--r-- | drivers/acpi/tables.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c index f336bca7c45..2572d9715bd 100644 --- a/drivers/acpi/tables.c +++ b/drivers/acpi/tables.c @@ -240,10 +240,17 @@ acpi_table_parse_entries(char *id, table_end) { if (entry->type == entry_id && (!max_entries || count++ < max_entries)) - if (handler(entry, table_end)) { - early_acpi_os_unmap_memory((char *)table_header, tbl_size); - return -EINVAL; - } + if (handler(entry, table_end)) + goto err; + + /* + * If entry->length is 0, break from this loop to avoid + * infinite loop. + */ + if (entry->length == 0) { + pr_err(PREFIX "[%4.4s:0x%02x] Invalid zero length\n", id, entry_id); + goto err; + } entry = (struct acpi_subtable_header *) ((unsigned long)entry + entry->length); @@ -255,6 +262,9 @@ acpi_table_parse_entries(char *id, early_acpi_os_unmap_memory((char *)table_header, tbl_size); return count; +err: + early_acpi_os_unmap_memory((char *)table_header, tbl_size); + return -EINVAL; } int __init |