Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eceeb437 authored by Dan Carpenter's avatar Dan Carpenter Committed by Matthew Garrett
Browse files

thinkpad_acpi: buffer overflow in fan_get_status() 



The acpi_evalf() function modifies four bytes of data but in
fan_get_status() we pass a pointer to u8.  I have modified the
function to use type checking now.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMatthew Garrett <mjg@redhat.com>
parent f661848b

drivers/platform/x86/thinkpad_acpi.c

+7 −6
Original line number Original line Diff line number Diff line
@@ -545,7 +545,7 @@ TPACPI_HANDLE(hkey, ec, "\\_SB.HKEY", /* 600e/x, 770e, 770x */ 
 */

 */





static int acpi_evalf(acpi_handle handle,

static int acpi_evalf(acpi_handle handle,

		      void *res, char *method, char *fmt, ...)

		      int *res, char *method, char *fmt, ...)

{

{

	char *fmt0 = fmt;

	char *fmt0 = fmt;

	struct acpi_object_list params;

	struct acpi_object_list params;
@@ -606,7 +606,7 @@ static int acpi_evalf(acpi_handle handle, 
		success = (status == AE_OK &&

		success = (status == AE_OK &&

			   out_obj.type == ACPI_TYPE_INTEGER);

			   out_obj.type == ACPI_TYPE_INTEGER);

		if (success && res)

		if (success && res)

			*(int *)res = out_obj.integer.value;

			*res = out_obj.integer.value;

		break;

		break;

	case 'v':		/* void */

	case 'v':		/* void */

		success = status == AE_OK;

		success = status == AE_OK;
@@ -7386,17 +7386,18 @@ static int fan_get_status(u8 *status) 
	 * Add TPACPI_FAN_RD_ACPI_FANS ? */

	 * Add TPACPI_FAN_RD_ACPI_FANS ? */





	switch (fan_status_access_mode) {

	switch (fan_status_access_mode) {

	case TPACPI_FAN_RD_ACPI_GFAN:

	case TPACPI_FAN_RD_ACPI_GFAN: {

		/* 570, 600e/x, 770e, 770x */

		/* 570, 600e/x, 770e, 770x */

		int res;





		if (unlikely(!acpi_evalf(gfan_handle, &s, NULL, "d")))

		if (unlikely(!acpi_evalf(gfan_handle, &res, NULL, "d")))

			return -EIO;

			return -EIO;





		if (likely(status))

		if (likely(status))

			*status = s & 0x07;

			*status = res & 0x07;





		break;

		break;



	}

	case TPACPI_FAN_RD_TPEC:

	case TPACPI_FAN_RD_TPEC:

		/* all except 570, 600e/x, 770e, 770x */

		/* all except 570, 600e/x, 770e, 770x */

		if (unlikely(!acpi_ec_read(fan_status_offset, &s)))

		if (unlikely(!acpi_ec_read(fan_status_offset, &s)))