mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 23:59:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]

Browse Source 
acpi_pcc_retrieve_biosdata() rejects SINF packages only when
pcc->num_sifr is strictly less than hkey->package.count, then
unconditionally writes a trailing sentinel at
pcc->sinf[hkey->package.count]. But pcc->sinf[] is allocated with
exactly pcc->num_sifr elements (valid indices 0..num_sifr-1), so that
write needs num_sifr strictly greater than package.count to stay in
bounds -- num_sifr == package.count passes the existing check but
still overflows by one element.

This is exactly the case probe()'s existing num_sifr++ workaround
("Some DSDT-s have an off-by-one bug where the SINF package count is
one higher than the SQTY reported value") is written to accommodate:
when a DSDT's SINF package count equals SQTY+1, the workaround makes
num_sifr equal to package.count, which is precisely the boundary that
overflows here. Found via UBSan (array-index-out-of-bounds) on
hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38
elements: num_sifr becomes 38 after the += 1 workaround, the loop
correctly fills indices 0..37, and the sentinel write then targets
index 38, one past the end -- a silent 4-byte heap overflow on kernels
without CONFIG_UBSAN.

Tightening the rejection check to num_sifr <= package.count would
avoid the overflow but breaks probe() entirely on exactly this
hardware, since num_sifr == package.count is the case the off-by-one
workaround exists to support. Nothing else in the driver reads this
sentinel value back, so simply skip the write when there is no room
for it instead.

Fixes: a3d0dbd18c ("platform/x86: panasonic-laptop: simplify allocation of sinf")
Cc: stable@vger.kernel.org
Signed-off-by: Hilgad Montelo <hilgad.montelo@gmail.com>
Link: https://patch.msgid.link/20260813221744.25668-4-hilgad.montelo@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
This commit is contained in:
Hilgad Montelo
2026-08-13 19:17:44 -03:00
committed by Ilpo Järvinen
parent 5ab078e324
commit 329f10d8be
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/platform/x86/panasonic-laptop.c
View File

@@ -358,7 +358,16 @@ static int acpi_pcc_retrieve_biosdata(struct pcc_acpi *pcc)
} else
pr_err("Invalid HKEY.SINF data\n");
}
pcc->sinf[hkey->package.count] = -1;
/*
* pcc->sinf[] has pcc->num_sifr elements (valid indices
* 0..num_sifr-1). On DSDTs where SINF's package count equals
* num_sifr exactly -- the off-by-one case probe()'s num_sifr++
* already allocates a spare element for -- there is no room left
* for this trailing sentinel; nothing reads it back, so just skip
* the write rather than running one element past the flex array.
*/
if (hkey->package.count < pcc->num_sifr)
pcc->sinf[hkey->package.count] = -1;
end:
kfree(buffer.pointer);