ACPI / debugfs: Fix buffer overflows, double free
authorVasiliy Kulikov <segoon@openwall.com>
Sat, 19 Feb 2011 13:18:08 +0000 (14:18 +0100)
committerGreg Kroah-Hartman <gregkh@suse.de>
Mon, 7 Mar 2011 23:05:17 +0000 (15:05 -0800)
commit29b37a14b0197d9d62e1886adaefd16f83b5b5f5
treec849ad5a3d271229664ce87a5ff41e0815f339e9
parentdeca27950a4fcf88963d99e3b926c0e78ab4e5df
ACPI / debugfs: Fix buffer overflows, double free

commit 2949ad50711cc161721cf788711722eeeca33764 upstream.

File position is not controlled, it may lead to overwrites of arbitrary
kernel memory.  Also the code may kfree() the same pointer multiple
times.

One more flaw is still present: if multiple processes open the file then
all 3 static variables are shared, leading to various race conditions.
They should be moved to file->private_data.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com>
Reviewed-by: Eugene Teo <eugeneteo@kernel.org>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/acpi/debugfs.c