Commit 28c2103dad04 "ACPI: Add D3 cold state" introduced a read past
the end of the array in drivers/acpi/bus.c
224 static int __acpi_bus_set_power(struct acpi_device *device, int state)
225 {
226 int result = 0;
227 acpi_status status = AE_OK;
228 char object_name[5] = { '_', 'P', 'S', '0' + state, '\0' };
229
230 if (!device || (state < ACPI_STATE_D0) || (state > ACPI_STATE_D3_COLD))
^^^^^^^^^^^^^^^^^^
This is 4 now.
231 return -EINVAL;
232
233 /* Make sure this is a valid target state */
234
235 if (state == device->power.state) {
236 ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Device is already at D%d\n",
237 state));
238 return 0;
239 }
240
241 if (!device->power.states[state].flags.valid) {
^^^^^^^^^^^^^
This array has 4 elements so we are one space past the end
of the array.
242 printk(KERN_WARNING PREFIX "Device does not support D%d\n", state);
243 return -ENODEV;
244 }
regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-acpi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
