iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ACPI: PRM: Handle memory allocation and memory remap failure

Browse Source 
Handle memory allocation and memory remap failure in acpi_parse_prmt()
when system runs out of memory to avoid the potential NULL pointer
dereference errors.

Signed-off-by: Aubrey Li <aubrey.li@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
Aubrey Li 2021-10-20 11:23:17 +08:00 committed by Rafael J. Wysocki
parent caa2bd07f5
commit c52ca71327
1 changed files with 26 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
drivers/acpi/prmt.c
View File

@ -96,7 +96,7 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
struct acpi_prmt_handler_info *handler_info; struct acpi_prmt_handler_info *handler_info;
struct prm_handler_info *th; struct prm_handler_info *th;
struct prm_module_info *tm; struct prm_module_info *tm;
u64 mmio_count = 0; u64 *mmio_count;
u64 cur_handler = 0; u64 cur_handler = 0;
u32 module_info_size = 0; u32 module_info_size = 0;
u64 mmio_range_size = 0; u64 mmio_range_size = 0;
@ -105,6 +105,8 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
module_info = (struct acpi_prmt_module_info *) header; module_info = (struct acpi_prmt_module_info *) header;
module_info_size = struct_size(tm, handlers, module_info->handler_info_count); module_info_size = struct_size(tm, handlers, module_info->handler_info_count);
tm = kmalloc(module_info_size, GFP_KERNEL); tm = kmalloc(module_info_size, GFP_KERNEL);
if (!tm)
goto parse_prmt_out1;
guid_copy(&tm->guid, (guid_t *) module_info->module_guid); guid_copy(&tm->guid, (guid_t *) module_info->module_guid);
tm->major_rev = module_info->major_rev; tm->major_rev = module_info->major_rev;
@ -117,14 +119,24 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
* Each module is associated with a list of addr * Each module is associated with a list of addr
* ranges that it can use during the service * ranges that it can use during the service
*/ */
mmio_count = *(u64 *) memremap(module_info->mmio_list_pointer, 8, MEMREMAP_WB); mmio_count = (u64 *) memremap(module_info->mmio_list_pointer, 8, MEMREMAP_WB);
mmio_range_size = struct_size(tm->mmio_info, addr_ranges, mmio_count); if (!mmio_count)
goto parse_prmt_out2;
mmio_range_size = struct_size(tm->mmio_info, addr_ranges, *mmio_count);
tm->mmio_info = kmalloc(mmio_range_size, GFP_KERNEL); tm->mmio_info = kmalloc(mmio_range_size, GFP_KERNEL);
if (!tm->mmio_info)
goto parse_prmt_out3;
temp_mmio = memremap(module_info->mmio_list_pointer, mmio_range_size, MEMREMAP_WB); temp_mmio = memremap(module_info->mmio_list_pointer, mmio_range_size, MEMREMAP_WB);
if (!temp_mmio)
goto parse_prmt_out4;
memmove(tm->mmio_info, temp_mmio, mmio_range_size); memmove(tm->mmio_info, temp_mmio, mmio_range_size);
} else { } else {
mmio_range_size = struct_size(tm->mmio_info, addr_ranges, mmio_count); tm->mmio_info = kmalloc(sizeof(*tm->mmio_info), GFP_KERNEL);
tm->mmio_info = kmalloc(mmio_range_size, GFP_KERNEL); if (!tm->mmio_info)
goto parse_prmt_out2;
tm->mmio_info->mmio_count = 0; tm->mmio_info->mmio_count = 0;
} }
@ -142,6 +154,15 @@ acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
} while (++cur_handler < tm->handler_count && (handler_info = get_next_handler(handler_info))); } while (++cur_handler < tm->handler_count && (handler_info = get_next_handler(handler_info)));
return 0; return 0;
parse_prmt_out4:
kfree(tm->mmio_info);
parse_prmt_out3:
memunmap(mmio_count);
parse_prmt_out2:
kfree(tm);
parse_prmt_out1:
return -ENOMEM;
} }
#define GET_MODULE 0 #define GET_MODULE 0