aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorFenghua Yu <fenghua.yu@intel.com>2012-09-25 11:11:43 -0700
committerLen Brown <len.brown@intel.com>2012-10-06 15:51:49 -0400
commit369d913b242cae2205471b11b6e33ac368ed33ec (patch)
tree046bc53317ba65818cca7a085e53bdf639a49acd
parentfc54ab72959edbf229b65ac74b2f122d799ca002 (diff)
ACPI: Harden acpi_table_parse_entries() against BIOS bug
Parsing acpi table entries may fall into an infinite loop on a buggy BIOS which has entry length=0 in acpi table. Instead of kernel hang with few failure clue which leads to heavy lifting debug effort, this patch hardens kernel boot by booting into non NUMA mode. The debug info left in log buffer helps people identify the issue. Signed-off-by: Fenghua Yu <fenghua.yu@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
-rw-r--r--drivers/acpi/tables.c18
1 files changed, 14 insertions, 4 deletions
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index f336bca7c450..2572d9715bda 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -240,10 +240,17 @@ acpi_table_parse_entries(char *id,
table_end) {
if (entry->type == entry_id
&& (!max_entries || count++ < max_entries))
- if (handler(entry, table_end)) {
- early_acpi_os_unmap_memory((char *)table_header, tbl_size);
- return -EINVAL;
- }
+ if (handler(entry, table_end))
+ goto err;
+
+ /*
+ * If entry->length is 0, break from this loop to avoid
+ * infinite loop.
+ */
+ if (entry->length == 0) {
+ pr_err(PREFIX "[%4.4s:0x%02x] Invalid zero length\n", id, entry_id);
+ goto err;
+ }
entry = (struct acpi_subtable_header *)
((unsigned long)entry + entry->length);
@@ -255,6 +262,9 @@ acpi_table_parse_entries(char *id,
early_acpi_os_unmap_memory((char *)table_header, tbl_size);
return count;
+err:
+ early_acpi_os_unmap_memory((char *)table_header, tbl_size);
+ return -EINVAL;
}
int __init