Sat Jul 24 11:36:41 2021 UTC ()
acpi: /dev/acpi: fix bounds check when reading tables


(jmcneill)
diff -r1.1 -r1.2 src/sys/dev/acpi/acpi_dev.c
cvs diff -r1.1 -r1.2 src/sys/dev/acpi/acpi_dev.c (expand / switch to unified diff)

--- src/sys/dev/acpi/acpi_dev.c 2020/12/06 02:57:30 1.1
+++ src/sys/dev/acpi/acpi_dev.c 2021/07/24 11:36:41 1.2
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: acpi_dev.c,v 1.1 2020/12/06 02:57:30 jmcneill Exp $ */ 1/* $NetBSD: acpi_dev.c,v 1.2 2021/07/24 11:36:41 jmcneill Exp $ */
2 2
3/*- 3/*-
4 * Copyright (c) 2020 Jared McNeill <jmcneill@invisible.ca> 4 * Copyright (c) 2020 Jared McNeill <jmcneill@invisible.ca>
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * Redistribution and use in source and binary forms, with or without 7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions 8 * modification, are permitted provided that the following conditions
9 * are met: 9 * are met:
10 * 1. Redistributions of source code must retain the above copyright 10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer. 11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright 12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the 13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution. 14 * documentation and/or other materials provided with the distribution.
@@ -17,27 +17,27 @@ @@ -17,27 +17,27 @@
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
22 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 22 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE. 26 * SUCH DAMAGE.
27 */ 27 */
28 28
29#include <sys/cdefs.h> 29#include <sys/cdefs.h>
30__KERNEL_RCSID(0, "$NetBSD: acpi_dev.c,v 1.1 2020/12/06 02:57:30 jmcneill Exp $"); 30__KERNEL_RCSID(0, "$NetBSD: acpi_dev.c,v 1.2 2021/07/24 11:36:41 jmcneill Exp $");
31 31
32#include <sys/param.h> 32#include <sys/param.h>
33#include <sys/conf.h> 33#include <sys/conf.h>
34#include <sys/mman.h> 34#include <sys/mman.h>
35 35
36#include <dev/acpi/acpireg.h> 36#include <dev/acpi/acpireg.h>
37#include <dev/acpi/acpivar.h> 37#include <dev/acpi/acpivar.h>
38 38
39#define _COMPONENT ACPI_BUS_COMPONENT 39#define _COMPONENT ACPI_BUS_COMPONENT
40ACPI_MODULE_NAME ("acpi_dev") 40ACPI_MODULE_NAME ("acpi_dev")
41 41
42static dev_type_read(acpi_read); 42static dev_type_read(acpi_read);
43 43
@@ -198,23 +198,23 @@ acpi_read(dev_t dev, struct uio *uio, in @@ -198,23 +198,23 @@ acpi_read(dev_t dev, struct uio *uio, in
198 size_t len; 198 size_t len;
199 199
200 if (uio->uio_rw != UIO_READ) { 200 if (uio->uio_rw != UIO_READ) {
201 return EPERM; 201 return EPERM;
202 } 202 }
203 203
204 /* Make sure this is a read of a known table */ 204 /* Make sure this is a read of a known table */
205 if (!acpi_find_table(uio->uio_offset, &table_pa, &table_len)) { 205 if (!acpi_find_table(uio->uio_offset, &table_pa, &table_len)) {
206 return EIO; 206 return EIO;
207 } 207 }
208 208
209 /* Copy the contents of the table to user-space */ 209 /* Copy the contents of the table to user-space */
210 pa = uio->uio_offset; 210 pa = uio->uio_offset;
211 len = uimin(pa - table_pa + table_len, uio->uio_resid); 211 len = uimin(table_len - (pa - table_pa), uio->uio_resid);
212 data = AcpiOsMapMemory(pa, len); 212 data = AcpiOsMapMemory(pa, len);
213 if (data == NULL) { 213 if (data == NULL) {
214 return ENOMEM; 214 return ENOMEM;
215 } 215 }
216 error = uiomove(data, len, uio); 216 error = uiomove(data, len, uio);
217 AcpiOsUnmapMemory(data, len); 217 AcpiOsUnmapMemory(data, len);
218 218
219 return error; 219 return error;
220} 220}