From: Dan Williams <dan.j.williams@intel.com>
To: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: Rafael Wysocki <rafael.j.wysocki@intel.com>,
Anush Seetharaman <anush.seetharaman@intel.com>,
Tiffany Kasanicky <tiffany.j.kasanicky@intel.com>,
Ryon Jensen <ryon.jensen@intel.com>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Stable <stable@vger.kernel.org>,
ACPI Devel Maling List <linux-acpi@vger.kernel.org>,
Kristin Jacque <kristin.jacque@intel.com>,
Zhang Rui <rui.zhang@intel.com>
Subject: Re: [PATCH v2] acpi: fix acpi_get_table() leak / acpi-sysfs denial of service
Date: Wed, 24 May 2017 12:01:20 -0700 [thread overview]
Message-ID: <CAPcyv4gpz_Msbevk1MEsfbO4nXySaRNSc7LC=D7NL-AdEdM0=g@mail.gmail.com> (raw)
In-Reply-To: <CAPcyv4i_mRLSxm7YAnk_p8PhP=kyhT1aZZcrG-zZxXXWhGQuew@mail.gmail.com>
On Wed, Apr 26, 2017 at 3:37 PM, Dan Williams <dan.j.williams@intel.com> wrote:
> On Wed, Apr 26, 2017 at 3:25 PM, Rafael J. Wysocki <rafael@kernel.org> wrote:
>> On Tue, Apr 25, 2017 at 9:58 PM, Dan Williams <dan.j.williams@intel.com> wrote:
>>> Reading an ACPI table through the /sys/firmware/acpi/tables interface
>>> more than 65,536 times leads to the following log message:
>>>
>>> ACPI Error: Table ffff88033595eaa8, Validation count is zero after increment
>>> (20170119/tbutils-423)
>>>
>>> ...and the table being unavailable until the next reboot. Add the
>>> missing acpi_put_table() so the table ->validation_count is decremented
>>> after each read.
>>>
>>> Cc: <stable@vger.kernel.org>
>>> Cc: Zhang Rui <rui.zhang@intel.com>
>>> Cc: Rafael Wysocki <rafael.j.wysocki@intel.com>
>>> Cc: Kristin Jacque <kristin.jacque@intel.com>
>>> Cc: Tiffany Kasanicky <tiffany.j.kasanicky@intel.com>
>>> Cc: Ryon Jensen <ryon.jensen@intel.com>
>>> Reported-by: Anush Seetharaman <anush.seetharaman@intel.com>
>>> Fixes: 1c8fce27e275 ("ACPI: introduce drivers/acpi/sysfs.c")
>>> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
>>
>> I'm going to apply this, but your Fixes tag is not correct.
>>
>> validation_count was added to struct acpi_table_desc by commit
>>
>> commit 174cc7187e6f088942c8e74daa7baff7b44b33c9
>> Author: Lv Zheng <lv.zheng@intel.com>
>> Date: Wed Dec 14 15:04:25 2016 +0800
>>
>> ACPICA: Tables: Back port acpi_get_table_with_size() and
>> early_acpi_os_unmap_memory()
>> from Linux kernel
>>
>> from the 4.10 time frame, so IMO it should be
>>
>> Fixes: 174cc7187e6f (ACPICA: Tables: Back port
>> acpi_get_table_with_size() and early_acpi_os_unmap_memory() from Linux
>> kernel)
>>
>
> Ah, thanks for the catch, I missed that detail and was wrong to argue
> it was a 7 year old bug. Apologies Lv!
Hi Rafael, I don't see this in latest Linus master or queued in your
bleeding-edge branch.
next prev parent reply other threads:[~2017-05-24 19:01 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-25 19:58 [PATCH v2] acpi: fix acpi_get_table() leak / acpi-sysfs denial of service Dan Williams
2017-04-26 22:25 ` Rafael J. Wysocki
2017-04-26 22:37 ` Dan Williams
2017-05-24 19:01 ` Dan Williams [this message]
2017-04-27 6:49 ` Zheng, Lv
2017-04-27 14:48 ` Dan Williams
2017-04-28 0:31 ` Rafael J. Wysocki
2017-04-28 1:13 ` Zheng, Lv
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAPcyv4gpz_Msbevk1MEsfbO4nXySaRNSc7LC=D7NL-AdEdM0=g@mail.gmail.com' \
--to=dan.j.williams@intel.com \
--cc=anush.seetharaman@intel.com \
--cc=kristin.jacque@intel.com \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rafael.j.wysocki@intel.com \
--cc=rafael@kernel.org \
--cc=rui.zhang@intel.com \
--cc=ryon.jensen@intel.com \
--cc=stable@vger.kernel.org \
--cc=tiffany.j.kasanicky@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).