Skip to content

Commit

Permalink
ACPI: Harden acpi_table_parse_entries() against BIOS bug
Browse files Browse the repository at this point in the history
Parsing acpi table entries may fall into an infinite loop on a buggy BIOS
which has entry length=0 in acpi table.

Instead of kernel hang with few failure clue which leads to heavy lifting debug
effort, this patch hardens kernel boot by booting into non NUMA mode. The debug
info left in log buffer helps people identify the issue.

Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
  • Loading branch information
Fenghua Yu authored and Len Brown committed Oct 6, 2012
1 parent fc54ab7 commit 369d913
Showing 1 changed file with 14 additions and 4 deletions.
18 changes: 14 additions & 4 deletions drivers/acpi/tables.c
Original file line number Diff line number Diff line change
Expand Up @@ -240,10 +240,17 @@ acpi_table_parse_entries(char *id,
table_end) {
if (entry->type == entry_id
&& (!max_entries || count++ < max_entries))
if (handler(entry, table_end)) {
early_acpi_os_unmap_memory((char *)table_header, tbl_size);
return -EINVAL;
}
if (handler(entry, table_end))
goto err;

/*
* If entry->length is 0, break from this loop to avoid
* infinite loop.
*/
if (entry->length == 0) {
pr_err(PREFIX "[%4.4s:0x%02x] Invalid zero length\n", id, entry_id);
goto err;
}

entry = (struct acpi_subtable_header *)
((unsigned long)entry + entry->length);
Expand All @@ -255,6 +262,9 @@ acpi_table_parse_entries(char *id,

early_acpi_os_unmap_memory((char *)table_header, tbl_size);
return count;
err:
early_acpi_os_unmap_memory((char *)table_header, tbl_size);
return -EINVAL;
}

int __init
Expand Down

0 comments on commit 369d913

Please sign in to comment.