linux/drivers/acpi
Dexuan Cui a58015d638 ACPI: scan: Harden acpi_device_add() against device ID overflows
Linux VM on Hyper-V crashes with the latest mainline:

[    4.069624] detected buffer overflow in strcpy
[    4.077733] kernel BUG at lib/string.c:1149!
..
[    4.085819] RIP: 0010:fortify_panic+0xf/0x11
...
[    4.085819] Call Trace:
[    4.085819]  acpi_device_add.cold.15+0xf2/0xfb
[    4.085819]  acpi_add_single_object+0x2a6/0x690
[    4.085819]  acpi_bus_check_add+0xc6/0x280
[    4.085819]  acpi_ns_walk_namespace+0xda/0x1aa
[    4.085819]  acpi_walk_namespace+0x9a/0xc2
[    4.085819]  acpi_bus_scan+0x78/0x90
[    4.085819]  acpi_scan_init+0xfa/0x248
[    4.085819]  acpi_init+0x2c1/0x321
[    4.085819]  do_one_initcall+0x44/0x1d0
[    4.085819]  kernel_init_freeable+0x1ab/0x1f4

This is because of the recent buffer overflow detection in the
commit 6a39e62abb ("lib: string.h: detect intra-object overflow in
fortified string functions")

Here acpi_device_bus_id->bus_id can only hold 14 characters, while the
the acpi_device_hid(device) returns a 22-char string
"HYPER_V_GEN_COUNTER_V1".

Per ACPI Spec v6.2, Section 6.1.5 _HID (Hardware ID), if the ID is a
string, it must be of the form AAA#### or NNNN####, i.e. 7 chars or 8
chars.

The field bus_id in struct acpi_device_bus_id was originally defined as
char bus_id[9], and later was enlarged to char bus_id[15] in 2007 in the
commit bb0958544f ("ACPI: use more understandable bus_id for ACPI
devices")

Fix the issue by changing the field bus_id to const char *, and use
kstrdup_const() to initialize it.

Signed-off-by: Dexuan Cui <decui@microsoft.com>
Tested-By: Jethro Beekman <jethro@fortanix.com>
[ rjw: Subject change, whitespace adjustment ]
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2021-01-11 20:45:31 +01:00
..
acpica ACPICA: Interpreter: fix memory leak by using existing buffer 2020-12-01 18:13:30 +01:00
apei Merge ACPI APEI material for v5.11. 2020-11-23 12:50:17 +01:00
arm64 Merge remote-tracking branch 'arm64/for-next/fixes' into for-next/core 2020-12-09 18:04:55 +00:00
dptf ACPI: DPTF: Support Alder Lake 2020-11-10 18:52:51 +01:00
nfit ACPI: NFIT: Fix input validation of bus-family 2020-11-23 17:43:53 -08:00
numa
pmic
x86 ACPI: PM: s2idle: Drop unused local variables and related code 2021-01-07 17:41:28 +01:00
Kconfig ACPI: Update Kconfig help text for items that are no longer modular 2021-01-07 17:48:37 +01:00
Makefile ACPI: PM: s2idle: Move x86-specific code to the x86 directory 2020-12-17 20:30:02 +01:00
ac.c
acpi_adxl.c
acpi_amba.c
acpi_apd.c
acpi_cmos_rtc.c
acpi_configfs.c
acpi_dbg.c ACPI: debug: Remove the not used function 2020-11-17 18:12:34 +01:00
acpi_extlog.c
acpi_ipmi.c
acpi_lpat.c
acpi_lpit.c
acpi_lpss.c
acpi_memhotplug.c
acpi_pad.c
acpi_platform.c
acpi_pnp.c ACPI: PNP: compare the string length in the matching_id() 2020-12-15 19:30:49 +01:00
acpi_processor.c
acpi_tad.c
acpi_video.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
acpi_watchdog.c ACPI: watchdog: Replace open coded variant of resource_union() 2020-11-17 18:06:29 +01:00
battery.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
bgrt.c
blacklist.c
bus.c
button.c ACPI: button: Add DMI quirk for Medion Akoya E2228T 2020-11-09 19:29:41 +01:00
container.c
cppc_acpi.c Merge branch 'pm-cpufreq' 2020-12-22 17:59:11 +01:00
custom_method.c
debugfs.c
device_pm.c PM: ACPI: Refresh wakeup device power configuration every time 2020-12-07 13:45:47 +01:00
device_sysfs.c
dock.c
ec.c ACPI: EC: Clean up status flags checks in advance_transaction() 2020-11-23 20:01:01 +01:00
ec_sys.c
event.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
evged.c ACPI: GED: fix -Wformat 2020-11-09 19:25:20 +01:00
fan.c ACPI: fan: Initialize performance state sysfs attribute 2020-11-16 15:18:38 +01:00
glue.c
hed.c
internal.h ACPI: scan: Harden acpi_device_add() against device ID overflows 2021-01-11 20:45:31 +01:00
ioapic.c
irq.c
nvs.c
osi.c
osl.c
pci_irq.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
pci_link.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
pci_mcfg.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
pci_root.c PCI/ACPI: Replace open coded variant of resource_union() 2020-11-17 18:06:28 +01:00
pci_slot.c
power.c Merge branches 'acpica' and 'acpi-scan' 2020-12-15 15:29:30 +01:00
pptt.c
proc.c
processor_core.c
processor_driver.c
processor_idle.c ACPI: processor: Remove the duplicated ACPI_PROCESSOR_CLASS macro 2020-11-17 18:12:34 +01:00
processor_pdc.c
processor_perflib.c More power management updates for 5.11-rc1 2020-12-22 14:12:10 -08:00
processor_thermal.c ACPI: processor: Remove the duplicated ACPI_PROCESSOR_CLASS macro 2020-11-17 18:12:34 +01:00
processor_throttling.c ACPI: processor: Remove the duplicated ACPI_PROCESSOR_CLASS macro 2020-11-17 18:12:34 +01:00
property.c driver core: Add fwnode_init() 2020-12-09 19:10:20 +01:00
reboot.c
resource.c ACPI updates for 5.11-rc1 2020-12-15 16:39:06 -08:00
sbs.c ACPI: SBS: Simplify the code using module_acpi_driver() 2020-11-17 18:12:34 +01:00
sbshc.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
sbshc.h ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00
scan.c ACPI: scan: Harden acpi_device_add() against device ID overflows 2021-01-11 20:45:31 +01:00
sleep.c ACPI: PM: s2idle: Move x86-specific code to the x86 directory 2020-12-17 20:30:02 +01:00
sleep.h ACPI: PM: s2idle: Move x86-specific code to the x86 directory 2020-12-17 20:30:02 +01:00
spcr.c
sysfs.c
tables.c
thermal.c
tiny-power-button.c ACPI: tiny-power-button: Simplify the code using module_acpi_driver() 2020-11-17 18:12:34 +01:00
utils.c
video_detect.c ACPI: video: Add DMI quirk for GIGABYTE GB-BXBT-2807 2020-12-07 14:01:22 +01:00
wakeup.c ACPI: Fix whitespace inconsistencies 2020-11-09 19:08:06 +01:00