From a1907d2235cdb0e58015932c52902bf92c494a8e Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Wed, 21 May 2014 20:33:13 +0000 Subject: [PATCH] [x86] ACPICA: Tables: Fix invalid pointer accesses in acpi_tb_parse_root_table(). (Closes: #748574) svn path=/dists/sid/linux/; revision=21354 --- debian/changelog | 7 ++ ...x-invalid-pointer-accesses-in-acpi_t.patch | 64 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 72 insertions(+) create mode 100644 debian/patches/bugfix/x86/ACPICA-Tables-Fix-invalid-pointer-accesses-in-acpi_t.patch diff --git a/debian/changelog b/debian/changelog index 442e08512..6af2ea06a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +linux (3.14.4-2) UNRELEASED; urgency=medium + + * [x86] ACPICA: Tables: Fix invalid pointer accesses in + acpi_tb_parse_root_table(). (Closes: #748574) + + -- Ben Hutchings Wed, 21 May 2014 21:24:50 +0100 + linux (3.14.4-1) unstable; urgency=high * New upstream stable update: diff --git a/debian/patches/bugfix/x86/ACPICA-Tables-Fix-invalid-pointer-accesses-in-acpi_t.patch b/debian/patches/bugfix/x86/ACPICA-Tables-Fix-invalid-pointer-accesses-in-acpi_t.patch new file mode 100644 index 000000000..636d6d033 --- /dev/null +++ b/debian/patches/bugfix/x86/ACPICA-Tables-Fix-invalid-pointer-accesses-in-acpi_t.patch @@ -0,0 +1,64 @@ +From: Lv Zheng +Date: Wed, 30 Apr 2014 10:05:40 +0800 +Subject: ACPICA: Tables: Fix invalid pointer accesses in + acpi_tb_parse_root_table(). +Origin: https://git.kernel.org/cgit/linux/kernel/git/rafael/linux-pm.git/commit?id=d48dc067450d84324067f4472dc0b169e9af4454 +Bug-Debian: https://bugs.debian.org/748574 + +Linux XSDT validation mechanism backport has introduced a regreession: + Commit: 671cc68dc61f029d44b43a681356078e02d8dab8 + Subject: ACPICA: Back port and refine validation of the XSDT root table. +There is a pointer still accessed after unmapping. + +This patch fixes this issue. Lv Zheng. + +Fixes: 671cc68dc61f (ACPICA: Back port and refine validation of the XSDT root table.) +References: https://bugzilla.kernel.org/show_bug.cgi?id=73911 +References: https://bugs.archlinux.org/task/39811 +Signed-off-by: Lv Zheng +Reported-and-tested-by: Bruce Chiarelli +Reported-and-tested-by: Spyros Stathopoulos +Signed-off-by: Bob Moore +Cc: 3.14+ # 3.14+ +Signed-off-by: Rafael J. Wysocki +--- + drivers/acpi/acpica/tbutils.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c +index a4702ee..9fb85f3 100644 +--- a/drivers/acpi/acpica/tbutils.c ++++ b/drivers/acpi/acpica/tbutils.c +@@ -461,6 +461,7 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address) + u32 table_count; + struct acpi_table_header *table; + acpi_physical_address address; ++ acpi_physical_address rsdt_address; + u32 length; + u8 *table_entry; + acpi_status status; +@@ -488,11 +489,14 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address) + * as per the ACPI specification. + */ + address = (acpi_physical_address) rsdp->xsdt_physical_address; ++ rsdt_address = ++ (acpi_physical_address) rsdp->rsdt_physical_address; + table_entry_size = ACPI_XSDT_ENTRY_SIZE; + } else { + /* Root table is an RSDT (32-bit physical addresses) */ + + address = (acpi_physical_address) rsdp->rsdt_physical_address; ++ rsdt_address = address; + table_entry_size = ACPI_RSDT_ENTRY_SIZE; + } + +@@ -515,8 +519,7 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address) + + /* Fall back to the RSDT */ + +- address = +- (acpi_physical_address) rsdp->rsdt_physical_address; ++ address = rsdt_address; + table_entry_size = ACPI_RSDT_ENTRY_SIZE; + } + } diff --git a/debian/patches/series b/debian/patches/series index 8aeea64f3..a0bb044a3 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -86,3 +86,4 @@ bugfix/all/net-ipv4-current-group_info-should-be-put-after-usin.patch bugfix/all/filter-prevent-nla-extensions-to-peek-beyond-the-end.patch debian/libata-avoid-abi-change-in-3.14.4.patch debian/dm-avoid-abi-change-in-3.14.4.patch +bugfix/x86/ACPICA-Tables-Fix-invalid-pointer-accesses-in-acpi_t.patch