瀏覽代碼

ACPI: Harden acpi_table_parse_entries() against BIOS bug

Parsing acpi table entries may fall into an infinite loop on a buggy BIOS
which has entry length=0 in acpi table.

Instead of kernel hang with few failure clue which leads to heavy lifting debug
effort, this patch hardens kernel boot by booting into non NUMA mode. The debug
info left in log buffer helps people identify the issue.

Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Fenghua Yu 12 年之前
父節點
當前提交
369d913b24
共有 1 個文件被更改,包括 14 次插入4 次删除
  1. 14 4
      drivers/acpi/tables.c

+ 14 - 4
drivers/acpi/tables.c

@@ -240,10 +240,17 @@ acpi_table_parse_entries(char *id,
 	       table_end) {
 	       table_end) {
 		if (entry->type == entry_id
 		if (entry->type == entry_id
 		    && (!max_entries || count++ < max_entries))
 		    && (!max_entries || count++ < max_entries))
-			if (handler(entry, table_end)) {
-				early_acpi_os_unmap_memory((char *)table_header, tbl_size);
-				return -EINVAL;
-			}
+			if (handler(entry, table_end))
+				goto err;
+
+		/*
+		 * If entry->length is 0, break from this loop to avoid
+		 * infinite loop.
+		 */
+		if (entry->length == 0) {
+			pr_err(PREFIX "[%4.4s:0x%02x] Invalid zero length\n", id, entry_id);
+			goto err;
+		}
 
 
 		entry = (struct acpi_subtable_header *)
 		entry = (struct acpi_subtable_header *)
 		    ((unsigned long)entry + entry->length);
 		    ((unsigned long)entry + entry->length);
@@ -255,6 +262,9 @@ acpi_table_parse_entries(char *id,
 
 
 	early_acpi_os_unmap_memory((char *)table_header, tbl_size);
 	early_acpi_os_unmap_memory((char *)table_header, tbl_size);
 	return count;
 	return count;
+err:
+	early_acpi_os_unmap_memory((char *)table_header, tbl_size);
+	return -EINVAL;
 }
 }
 
 
 int __init
 int __init