kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/include
History
Ahmed Salem 475c69146b ACPICA: Avoid sequence overread in call to strncmp() 
[ Upstream commit 64b9dfd077 ]

ACPICA commit 8b83a8d88dfec59ea147fad35fc6deea8859c58c

ap_get_table_length() checks if tables are valid by
calling ap_is_valid_header(). The latter then calls
ACPI_VALIDATE_RSDP_SIG(Table->Signature).

ap_is_valid_header() accepts struct acpi_table_header as an argument, so
the signature size is always fixed to 4 bytes.

The problem is when the string comparison is between ACPI-defined table
signature and ACPI_SIG_RSDP. Common ACPI table header specifies the
Signature field to be 4 bytes long[1], with the exception of the RSDP
structure whose signature is 8 bytes long "RSD PTR " (including the
trailing blank character)[2]. Calling strncmp(sig, rsdp_sig, 8) would
then result in a sequence overread[3] as sig would be smaller (4 bytes)
than the specified bound (8 bytes).

As a workaround, pass the bound conditionally based on the size of the
signature being passed.

Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#system-description-table-header [1]
Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#root-system-description-pointer-rsdp-structure [2]
Link: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wstringop-overread [3]
Link: 8b83a8d8
Signed-off-by: Ahmed Salem <x0rw3ll@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2248233.Mh6RI2rZIc@rjwysocki.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-06-27 11:07:32 +01:00
..
acpi ACPICA: Avoid sequence overread in call to strncmp() 2025-06-27 11:07:32 +01:00
asm-generic vmlinux.lds: Ensure that const vars with relocations are mapped R/O 2025-03-07 16:56:50 +01:00
clocksource x86/hyperv: Fix hv tsc page based sched_clock for hibernation 2025-01-09 13:29:56 +01:00
crypto crypto: simd - Do not call crypto_alloc_tfm during registration 2024-10-17 15:21:39 +02:00
drm drm/atomic: clarify the rules around drm_atomic_state->allow_modeset 2025-06-04 14:40:18 +02:00
dt-bindings ASoC: qcom: q6dsp: add support to more display ports 2025-05-02 07:46:53 +02:00
keys certs: Move load_certificate_list() to be with the asymmetric keys code 2022-06-21 16:05:06 +01:00
kunit kunit: add macro to allow conditionally exposing static symbols to tests 2023-11-20 11:52:08 +01:00
kvm KVM: arm64: Fix host-programmed guest events in nVHE 2024-04-10 16:28:23 +02:00
linux mmc: Add quirk to disable DDR50 tuning 2025-06-27 11:07:32 +01:00
math-emu powerpc/math-emu: Remove -w build flag and fix warnings 2022-09-05 17:28:25 +10:00
media media: v4l2-core: v4l2-dv-timings: check cvt/gtf result 2024-12-14 19:54:04 +01:00
memory memory: renesas-rpc-if: Remove Runtime PM wrappers 2024-12-14 19:53:37 +01:00
misc ocxl: Update the Process Element Entry 2020-12-04 01:01:30 +11:00
net net: Fix TOCTOU issue in sk_is_readable() 2025-06-27 11:07:22 +01:00
pcmcia ARM: pxa/sa1100: move I/O space to PCI_IOBASE 2022-05-07 22:56:17 +02:00
ras mm, hwpoison: enable memory error handling on 1GB hugepage 2022-08-08 18:06:44 -07:00
rdma RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() 2025-06-04 14:40:06 +02:00
rv rv: Reset per-task monitors also for idle tasks 2025-02-21 13:49:47 +01:00
scsi scsi: core: Fix the return value of scsi_logical_block_count() 2024-08-29 17:30:49 +02:00
soc net: mscc: ocelot: treat 802.1ad tagged traffic as 802.1Q-untagged 2025-05-09 09:41:39 +02:00
sound ALSA: pcm: Fix race of buffer access at PCM OSS layer 2025-06-04 14:40:20 +02:00
target scsi: target: Fix multiple LUN_RESET handling 2023-05-11 23:03:19 +09:00
trace btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref 2025-06-04 14:40:18 +02:00
uapi binfmt: Fix whitespace issues 2025-05-22 14:09:58 +02:00
ufs scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions 2025-02-21 13:49:42 +01:00
vdso time64.h: Consolidated PSEC_PER_SEC definition 2021-04-06 16:32:17 -07:00
video video: Provide constants for VGA I/O range 2022-07-19 13:19:11 +02:00
xen xen/mcelog: Add __nonstring annotations for unterminated strings 2025-04-25 10:43:27 +02:00