ACPICA: Resource Mgr: Prevent infinite loops in resource walks

Add checks for zero-length resource descriptors in all code that
loops through a resource descriptor list. This prevents possible
infinite loops because the length is used to increment the traveral
pointer and detect the end-of-descriptor.

Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

diff --git a/drivers/acpi/acpica/rscalc.c b/drivers/acpi/acpica/rscalc.c
index 7816d4eef04e1afebf0a0b8aea0b660a4f81b62f..72077fa1eea5ecd7e5c489e3b65632c0be639ef2 100644 (file)
--- a/drivers/acpi/acpica/rscalc.c
+++ b/drivers/acpi/acpica/rscalc.c
@@ -202,6 +202,12 @@ acpi_rs_get_aml_length(struct acpi_resource * resource, acpi_size * size_needed)
                        return_ACPI_STATUS(AE_AML_INVALID_RESOURCE_TYPE);
                }
 
+               /* Sanity check the length. It must not be zero, or we loop forever */
+
+               if (!resource->length) {
+                       return_ACPI_STATUS(AE_AML_BAD_RESOURCE_LENGTH);
+               }
+
                /* Get the base size of the (external stream) resource descriptor */
 
                total_size = acpi_gbl_aml_resource_sizes[resource->type];

diff --git a/drivers/acpi/acpica/rsdump.c b/drivers/acpi/acpica/rsdump.c
index cab51445189d03b649f27ebf5000be33634bdb61..b5fc0db2e87bb4a78ddbaa707ee91a886b4e7215 100644 (file)
--- a/drivers/acpi/acpica/rsdump.c
+++ b/drivers/acpi/acpica/rsdump.c
@@ -385,6 +385,14 @@ void acpi_rs_dump_resource_list(struct acpi_resource *resource_list)
                        return;
                }
 
+               /* Sanity check the length. It must not be zero, or we loop forever */
+
+               if (!resource_list->length) {
+                       acpi_os_printf
+                           ("Invalid zero length descriptor in resource list\n");
+                       return;
+               }
+
                /* Dump the resource descriptor */
 
                if (type == ACPI_RESOURCE_TYPE_SERIAL_BUS) {

diff --git a/drivers/acpi/acpica/rslist.c b/drivers/acpi/acpica/rslist.c
index ee2e206fc6c8e8dbad901ad67653cd7d697e2273..6053aa182093e75b070ecd89bd318348d6f2b62f 100644 (file)
--- a/drivers/acpi/acpica/rslist.c
+++ b/drivers/acpi/acpica/rslist.c
@@ -178,6 +178,14 @@ acpi_rs_convert_resources_to_aml(struct acpi_resource *resource,
                        return_ACPI_STATUS(AE_BAD_DATA);
                }
 
+               /* Sanity check the length. It must not be zero, or we loop forever */
+
+               if (!resource->length) {
+                       ACPI_ERROR((AE_INFO,
+                                   "Invalid zero length descriptor in resource list\n"));
+                       return_ACPI_STATUS(AE_AML_BAD_RESOURCE_LENGTH);
+               }
+
                /* Perform the conversion */
 
                if (resource->type == ACPI_RESOURCE_TYPE_SERIAL_BUS) {

diff --git a/drivers/acpi/acpica/rsxface.c b/drivers/acpi/acpica/rsxface.c
index 15d6eaef0e286a21f01d9eee5636e46d7e75c5e2..c0e5d2d3ce6757380928c9e50d1f2de0f158160a 100644 (file)
--- a/drivers/acpi/acpica/rsxface.c
+++ b/drivers/acpi/acpica/rsxface.c
@@ -563,13 +563,19 @@ acpi_walk_resource_buffer(struct acpi_buffer * buffer,
 
        while (resource < resource_end) {
 
-               /* Sanity check the resource */
+               /* Sanity check the resource type */
 
                if (resource->type > ACPI_RESOURCE_TYPE_MAX) {
                        status = AE_AML_INVALID_RESOURCE_TYPE;
                        break;
                }
 
+               /* Sanity check the length. It must not be zero, or we loop forever */
+
+               if (!resource->length) {
+                       return_ACPI_STATUS(AE_AML_BAD_RESOURCE_LENGTH);
+               }
+
                /* Invoke the user function, abort on any error returned */
 
                status = user_function(resource, context);