Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0093cb11 authored by Len Brown's avatar Len Brown Committed by Linus Torvalds
Browse files

pnpacpi: fix potential corruption on "pnpacpi: exceeded the max number of IRQ resources 2" 



PNP_MAX_IRQ is 2
If a device invokes pnpacpi_parse_allocated_irqresource() 0, 1, or 2 times, we are happy.
The 3rd time, we will fail and print "pnpacpi: exceeded the max number of IRQ resources: 2"
The 4th and subsequent calls (if this ever happened) would silently scribble on
irq_resource[2], which doesn't actualy exist.

Found-by: default avatarBjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: default avatarLen Brown <len.brown@intel.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 94bc891b

drivers/pnp/pnpacpi/rsparser.c

+6 −4
Original line number Diff line number Diff line
@@ -84,10 +84,12 @@ static void pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res, 
	while (!(res->irq_resource[i].flags & IORESOURCE_UNSET) &&

	       i < PNP_MAX_IRQ)

		i++;

	if (i >= PNP_MAX_IRQ && !warned) {

		printk(KERN_WARNING "pnpacpi: exceeded the max number of IRQ "

				"resources: %d \n", PNP_MAX_IRQ);

	if (i >= PNP_MAX_IRQ) {

		if (!warned) {

			printk(KERN_WARNING "pnpacpi: exceeded the max number"

				" of IRQ resources: %d\n", PNP_MAX_IRQ);

			warned = 1;

		}

		return;

	}

	/*