Skip to content
Commit 31932041 authored by Dan Williams's avatar Dan Williams
Browse files

nfit: fix _FIT evaluation memory leak + use after free



acpi_evaluate_object() allocates memory. Free the buffer allocated
during acpi_nfit_add(). In order for this memory to be freed
acpi_nfit_init() needs to be converted to duplicate the nfit contents in
its internal allocation.  Use zero-length arrays to minimize the thrash
with the rest of the nfit driver implementation.

All of the add_<nfit-sub-table>() routines now validate a minimum table
size and expect hotplugged tables to match the size of the original
table to count as a duplicate. For variable length tables, like 'idt'
and 'flush', we calculate the dynamic size. Note that hotplug by
definition cannot change the interleave as it would cause data
corruption of in-use namespaces.

Cc: Vishal Verma <vishal.l.verma@intel.com>
Reported-by: default avatarXiao Guangrong <guangrong.xiao@intel.com>
Reported-by: default avatarHaozhong Zhang <haozhong.zhang@intel.com>
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
parent 5dc68e55
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment