• Dan Williams's avatar
    nfit: fix _FIT evaluation memory leak + use after free · 31932041
    Dan Williams authored
    acpi_evaluate_object() allocates memory. Free the buffer allocated
    during acpi_nfit_add(). In order for this memory to be freed
    acpi_nfit_init() needs to be converted to duplicate the nfit contents in
    its internal allocation.  Use zero-length arrays to minimize the thrash
    with the rest of the nfit driver implementation.
    
    All of the add_<nfit-sub-table>() routines now validate a minimum table
    size and expect hotplugged tables to match the size of the original
    table to count as a duplicate. For variable length tables, like 'idt'
    and 'flush', we calculate the dynamic size. Note that hotplug by
    definition cannot change the interleave as it would cause data
    corruption of in-use namespaces.
    
    Cc: Vishal Verma <vishal.l.verma@intel.com>
    Reported-by: default avatarXiao Guangrong <guangrong.xiao@intel.com>
    Reported-by: default avatarHaozhong Zhang <haozhong.zhang@intel.com>
    Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
    31932041
nfit.h 5.38 KB