* re: ACPI: Add D3 cold state
@ 2011-05-30 8:42 Dan Carpenter
2011-05-30 8:57 ` Lin Ming
0 siblings, 1 reply; 4+ messages in thread
From: Dan Carpenter @ 2011-05-30 8:42 UTC (permalink / raw)
To: ming.m.lin; +Cc: open list:ACPI, Len Brown
Commit 28c2103dad04 "ACPI: Add D3 cold state" introduced a read past
the end of the array in drivers/acpi/bus.c
224 static int __acpi_bus_set_power(struct acpi_device *device, int state)
225 {
226 int result = 0;
227 acpi_status status = AE_OK;
228 char object_name[5] = { '_', 'P', 'S', '0' + state, '\0' };
229
230 if (!device || (state < ACPI_STATE_D0) || (state > ACPI_STATE_D3_COLD))
^^^^^^^^^^^^^^^^^^
This is 4 now.
231 return -EINVAL;
232
233 /* Make sure this is a valid target state */
234
235 if (state == device->power.state) {
236 ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Device is already at D%d\n",
237 state));
238 return 0;
239 }
240
241 if (!device->power.states[state].flags.valid) {
^^^^^^^^^^^^^
This array has 4 elements so we are one space past the end
of the array.
242 printk(KERN_WARNING PREFIX "Device does not support D%d\n", state);
243 return -ENODEV;
244 }
regards,
dan carpenter
^ permalink raw reply [flat|nested] 4+ messages in thread* re: ACPI: Add D3 cold state
2011-05-30 8:42 ACPI: Add D3 cold state Dan Carpenter
@ 2011-05-30 8:57 ` Lin Ming
2011-05-30 9:14 ` Dan Carpenter
0 siblings, 1 reply; 4+ messages in thread
From: Lin Ming @ 2011-05-30 8:57 UTC (permalink / raw)
To: Dan Carpenter; +Cc: open list:ACPI, Len Brown
On Mon, 2011-05-30 at 16:42 +0800, Dan Carpenter wrote:
> Commit 28c2103dad04 "ACPI: Add D3 cold state" introduced a read past
> the end of the array in drivers/acpi/bus.c
>
> 224 static int __acpi_bus_set_power(struct acpi_device *device, int state)
> 225 {
> 226 int result = 0;
> 227 acpi_status status = AE_OK;
> 228 char object_name[5] = { '_', 'P', 'S', '0' + state, '\0' };
> 229
> 230 if (!device || (state < ACPI_STATE_D0) || (state > ACPI_STATE_D3_COLD))
> ^^^^^^^^^^^^^^^^^^
> This is 4 now.
>
> 231 return -EINVAL;
> 232
> 233 /* Make sure this is a valid target state */
> 234
> 235 if (state == device->power.state) {
> 236 ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Device is already at D%d\n",
> 237 state));
> 238 return 0;
> 239 }
> 240
> 241 if (!device->power.states[state].flags.valid) {
> ^^^^^^^^^^^^^
> This array has 4 elements so we are one space past the end
> of the array.
Ah! We need fix like below.
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index 3a10ef5..ff246e8 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -210,7 +210,7 @@ struct acpi_device_power_state {
struct acpi_device_power {
int state; /* Current state */
struct acpi_device_power_flags flags;
- struct acpi_device_power_state states[4]; /* Power states (D0-D3) */
+ struct acpi_device_power_state states[5]; /* Power states (D0-D3Cold) */
};
/* Performance Management */
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2011-05-30 13:10 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-05-30 8:42 ACPI: Add D3 cold state Dan Carpenter
2011-05-30 8:57 ` Lin Ming
2011-05-30 9:14 ` Dan Carpenter
2011-05-30 13:10 ` Lin Ming
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox