Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Merge tag 'acpi-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI fixes from Rafael Wysocki:
"These address a device ID bounds check error in the device enumeration
code and fix a mistake in the documentation.

Specifics:

- Harden the ACPI device enumeration code against device ID length
overflows to address a Linux VM cash on Hyper-V (Dexuan Cui).

- Fix a mistake in the documentation of error type values for PCIe
errors (Qiuxu Zhuo)"

* tag 'acpi-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
Documentation: ACPI: EINJ: Fix error type values for PCIe errors
ACPI: scan: Harden acpi_device_add() against device ID overflows

+17 -4
+2 -2
Documentation/firmware-guide/acpi/apei/einj.rst
··· 50 50 0x00000010 Memory Uncorrectable non-fatal 51 51 0x00000020 Memory Uncorrectable fatal 52 52 0x00000040 PCI Express Correctable 53 - 0x00000080 PCI Express Uncorrectable fatal 54 - 0x00000100 PCI Express Uncorrectable non-fatal 53 + 0x00000080 PCI Express Uncorrectable non-fatal 54 + 0x00000100 PCI Express Uncorrectable fatal 55 55 0x00000200 Platform Correctable 56 56 0x00000400 Platform Uncorrectable non-fatal 57 57 0x00000800 Platform Uncorrectable fatal
+1 -1
drivers/acpi/internal.h
··· 97 97 extern struct list_head acpi_bus_id_list; 98 98 99 99 struct acpi_device_bus_id { 100 - char bus_id[15]; 100 + const char *bus_id; 101 101 unsigned int instance_no; 102 102 struct list_head node; 103 103 };
+14 -1
drivers/acpi/scan.c
··· 486 486 acpi_device_bus_id->instance_no--; 487 487 else { 488 488 list_del(&acpi_device_bus_id->node); 489 + kfree_const(acpi_device_bus_id->bus_id); 489 490 kfree(acpi_device_bus_id); 490 491 } 491 492 break; ··· 675 674 } 676 675 if (!found) { 677 676 acpi_device_bus_id = new_bus_id; 678 - strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device)); 677 + acpi_device_bus_id->bus_id = 678 + kstrdup_const(acpi_device_hid(device), GFP_KERNEL); 679 + if (!acpi_device_bus_id->bus_id) { 680 + pr_err(PREFIX "Memory allocation error for bus id\n"); 681 + result = -ENOMEM; 682 + goto err_free_new_bus_id; 683 + } 684 + 679 685 acpi_device_bus_id->instance_no = 0; 680 686 list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); 681 687 } ··· 717 709 if (device->parent) 718 710 list_del(&device->node); 719 711 list_del(&device->wakeup_list); 712 + 713 + err_free_new_bus_id: 714 + if (!found) 715 + kfree(new_bus_id); 716 + 720 717 mutex_unlock(&acpi_device_lock); 721 718 722 719 err_detach: