diff options
| author | Lv Zheng <lv.zheng@intel.com> | 2013-11-21 08:17:34 +0400 |
|---|---|---|
| committer | Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 2013-11-21 16:47:04 +0400 |
| commit | 9a0a35972591f91167556b4a61673d08ef07f310 (patch) | |
| tree | 81dc770c8618c8a8e5f6a147592cdd7a79b18565 /drivers/acpi/acpica/rsutils.c | |
| parent | c38f671e390fe0d1605b402a28b01b1dbf8e10b3 (diff) | |
| download | linux-9a0a35972591f91167556b4a61673d08ef07f310.tar.xz | |
ACPICA: Resources: Fix loop termination for the get AML length function.
The loop terminates on a NULL resource pointer, which can never
happen since the loop simply increments a valid resource pointer.
This fix changes the loop to terminate on an end-of-buffer condition.
Problem can be seen by callers to AcpiSetCurrentResources with an
invalid or corrupted resource descriptor; or a resource descriptor
without an END_TAG descriptor.
(refined by Bob Moore)
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Diffstat (limited to 'drivers/acpi/acpica/rsutils.c')
| -rw-r--r-- | drivers/acpi/acpica/rsutils.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/acpi/acpica/rsutils.c b/drivers/acpi/acpica/rsutils.c index aef303d56d86..14a7982c9961 100644 --- a/drivers/acpi/acpica/rsutils.c +++ b/drivers/acpi/acpica/rsutils.c @@ -753,7 +753,7 @@ acpi_rs_set_srs_method_data(struct acpi_namespace_node *node, * Convert the linked list into a byte stream */ buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER; - status = acpi_rs_create_aml_resources(in_buffer->pointer, &buffer); + status = acpi_rs_create_aml_resources(in_buffer, &buffer); if (ACPI_FAILURE(status)) { goto cleanup; } |