All of lore.kernel.org
 help / color / mirror / Atom feed
From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Henrique de Moraes Holschuh <ibm-acpi@hmh.eng.br>,
	Matthew Garrett <mjg@redhat.com>,
	"open list:THINKPAD ACPI EXT..."
	<ibm-acpi-devel@lists.sourceforge.net>,
	"open list:THINKPAD ACPI EXT..."
	<platform-driver-x86@vger.kernel.org>,
	kernel-janitors@vger.kernel.org
Subject: Re: [patch] thinkpad_acpi: buffer overflow in fan_get_status()
Date: Sat, 01 Sep 2012 20:16:46 +0000	[thread overview]
Message-ID: <20120901201646.GA5422@khazad-dum.debian.net> (raw)
In-Reply-To: <20120901195407.GF20741@mwanda>

On Sat, 01 Sep 2012, Dan Carpenter wrote:
> The acpi_evalf() function modifies four bytes of data but in
> fan_get_status() we pass a pointer to u8.  I have modified the
> function to use type checking now.

This makes the function unextensible to return other ACPI object types, but
it can be changed back to void* later if required.

> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>

Thanks for noticing this problem, fortunately it affects only _really_
ancient thinkpads, which are extremely rare.

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh

WARNING: multiple messages have this Message-ID (diff)
From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Henrique de Moraes Holschuh <ibm-acpi@hmh.eng.br>,
	Matthew Garrett <mjg@redhat.com>,
	"open list:THINKPAD ACPI EXT..."
	<ibm-acpi-devel@lists.sourceforge.net>,
	"open list:THINKPAD ACPI EXT..."
	<platform-driver-x86@vger.kernel.org>,
	kernel-janitors@vger.kernel.org
Subject: Re: [patch] thinkpad_acpi: buffer overflow in fan_get_status()
Date: Sat, 1 Sep 2012 17:16:46 -0300	[thread overview]
Message-ID: <20120901201646.GA5422@khazad-dum.debian.net> (raw)
In-Reply-To: <20120901195407.GF20741@mwanda>

On Sat, 01 Sep 2012, Dan Carpenter wrote:
> The acpi_evalf() function modifies four bytes of data but in
> fan_get_status() we pass a pointer to u8.  I have modified the
> function to use type checking now.

This makes the function unextensible to return other ACPI object types, but
it can be changed back to void* later if required.

> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>

Thanks for noticing this problem, fortunately it affects only _really_
ancient thinkpads, which are extremely rare.

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh

  reply	other threads:[~2012-09-01 20:16 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-09-01 19:54 [patch] thinkpad_acpi: buffer overflow in fan_get_status() Dan Carpenter
2012-09-01 19:54 ` Dan Carpenter
2012-09-01 20:16 ` Henrique de Moraes Holschuh [this message]
2012-09-01 20:16   ` Henrique de Moraes Holschuh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20120901201646.GA5422@khazad-dum.debian.net \
    --to=hmh@hmh.eng.br \
    --cc=dan.carpenter@oracle.com \
    --cc=ibm-acpi-devel@lists.sourceforge.net \
    --cc=ibm-acpi@hmh.eng.br \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=mjg@redhat.com \
    --cc=platform-driver-x86@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.