Attachment 609475 Details for Bug 826067 – [RHEL 6.4 PATCH] ACPI: Fix use-after-free in acpi_map_lsapic

[patch] [RHEL 6.4 PATCH] ACPI: Fix use-after-free in acpi_map_lsapic

0001-ACPI-Fix-use-after-free-in-acpi_map_lsapic.patch (text/plain), 2.14 KB, created by Igor Mammedov on 2012-09-03 21:11:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Igor Mammedov

Created: 2012-09-03 21:11:39 UTC

Size: 2.14 KB

patch

obsolete

>From efd364cc3d90808eccca759e81045847eefd07ec Mon Sep 17 00:00:00 2001
>From: Petr Vandrovec <petr@vmware.com>
>Date: Thu, 8 Mar 2012 13:33:24 -0800
>Subject: [RHEL 6.4 PATCH] ACPI: Fix use-after-free in acpi_map_lsapic
>
>BZ: 826067
>Brew: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=4824506
>
>upstream commit: ac909ec308ce8d5177963c780564824d12bc3fa2
>
>----
>When processor is being hot-added to the system, acpi_map_lsapic invokes
>ACPI _MAT method to find APIC ID and flags, verifies that returned structure
>is indeed ACPI's local APIC structure, and that flags contain MADT_ENABLED
>bit.  Then saves APIC ID, frees structure - and accesses structure when
>computing arguments for acpi_register_lapic call.  Which sometime leads
>to acpi_register_lapic call being made with second argument zero, failing
>to bring processor online with error 'Unable to map lapic to logical cpu
>number'.
>
>As lapic->lapic_flags & ACPI_MADT_ENABLED was already confirmed to be non-zero
>few lines above, we can just pass unconditional ACPI_MADT_ENABLED to the
>acpi_register_lapic.
>
>Signed-off-by: Petr Vandrovec <petr@vmware.com>
>Signed-off-by: Alok N Kataria <akataria@vmware.com>
>Reviewed-by: Toshi Kani <toshi.kani@hp.com>
>Signed-off-by: Len Brown <len.brown@intel.com>
>----
>
>Signed-off-by: Igor Mammedov <imammedo@redhat.com>
>---
> arch/x86/kernel/acpi/boot.c |    3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
>diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
>index 564b6da..f765643 100644
>--- a/arch/x86/kernel/acpi/boot.c
>+++ b/arch/x86/kernel/acpi/boot.c
>@@ -551,6 +551,7 @@ static int __cpuinit _acpi_map_lsapic(acpi_handle handle, int *pcpu)
> 	kfree(buffer.pointer);
> 	buffer.length = ACPI_ALLOCATE_BUFFER;
> 	buffer.pointer = NULL;
>+	lapic = NULL;
> 
> 	if (!alloc_cpumask_var(&tmp_map, GFP_KERNEL))
> 		goto out;
>@@ -559,7 +560,7 @@ static int __cpuinit _acpi_map_lsapic(acpi_handle handle, int *pcpu)
> 		goto free_tmp_map;
> 
> 	cpumask_copy(tmp_map, cpu_present_mask);
>-	acpi_register_lapic(physid, lapic->lapic_flags & ACPI_MADT_ENABLED);
>+	acpi_register_lapic(physid, ACPI_MADT_ENABLED);
> 
> 	/*
> 	 * If mp_register_lapic successfully generates a new logical cpu
>-- 
>1.7.1
>

Actions: View | Diff

Attachments on bug 826067: 609475