diff options
| author | Vasiliy Kulikov <segoon@openwall.com> | 2011-02-19 16:18:08 +0300 |
|---|---|---|
| committer | Rafael J. Wysocki <rjw@sisk.pl> | 2011-02-24 21:59:06 +0300 |
| commit | 2949ad50711cc161721cf788711722eeeca33764 (patch) | |
| tree | aba75138e732b43cc2c92ee2f310a0b457c70ebd /drivers/acpi/acpica/evgpe.c | |
| parent | 2aa15890f3c191326678f1bd68af61ec6b8753ec (diff) | |
| download | linux-2949ad50711cc161721cf788711722eeeca33764.tar.xz | |
ACPI / debugfs: Fix buffer overflows, double free
File position is not controlled, it may lead to overwrites of arbitrary
kernel memory. Also the code may kfree() the same pointer multiple
times.
One more flaw is still present: if multiple processes open the file then
all 3 static variables are shared, leading to various race conditions.
They should be moved to file->private_data.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com>
Reviewed-by: Eugene Teo <eugeneteo@kernel.org>
Cc: stable@kernel.org
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Diffstat (limited to 'drivers/acpi/acpica/evgpe.c')
0 files changed, 0 insertions, 0 deletions