From: Bob Moore <robert.moore@intel.com>
Date: Thu, 10 Apr 2008 15:06:39 +0000 (+0400)
Subject: ACPICA: Add a table checksum verify for Load operator
X-Git-Tag: v2.6.26-rc1~101^2~47
X-Git-Url: http://pilppa.org/gitweb/?a=commitdiff_plain;h=98af37fba9b3e601ca4bded51ef51a2be4e8c97b;p=linux-2.6-omap-h63xx.git

ACPICA: Add a table checksum verify for Load operator

Added a table checksum verification for the Load operator, in
the case where the load is from a buffer.

http://www.acpica.org/bugzilla/show_bug.cgi?id=578

Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
Signed-off-by: Len Brown <len.brown@intel.com>
---

diff --git a/drivers/acpi/executer/exconfig.c b/drivers/acpi/executer/exconfig.c
index a0f34b467a2..dbf1e6f33bb 100644
--- a/drivers/acpi/executer/exconfig.c
+++ b/drivers/acpi/executer/exconfig.c
@@ -275,6 +275,7 @@ acpi_ex_load_op(union acpi_operand_object *obj_desc,
 	struct acpi_table_desc table_desc;
 	acpi_native_uint table_index;
 	acpi_status status;
+	u32 length;
 
 	ACPI_FUNCTION_TRACE(ex_load_op);
 
@@ -322,18 +323,35 @@ acpi_ex_load_op(union acpi_operand_object *obj_desc,
 				  "Load from Buffer or Field %p %s\n", obj_desc,
 				  acpi_ut_get_object_type_name(obj_desc)));
 
+		length = obj_desc->buffer.length;
+
+		/* Must have at least an ACPI table header */
+
+		if (length < sizeof(struct acpi_table_header)) {
+			return_ACPI_STATUS(AE_INVALID_TABLE_LENGTH);
+		}
+
+		/* Validate checksum here. It won't get validated in tb_add_table */
+
+		status = acpi_tb_verify_checksum((struct acpi_table_header *)
+						 obj_desc->buffer.pointer,
+						 length);
+		if (ACPI_FAILURE(status)) {
+			return_ACPI_STATUS(status);
+		}
+
 		/*
 		 * We need to copy the buffer since the original buffer could be
 		 * changed or deleted in the future
 		 */
-		table_desc.pointer = ACPI_ALLOCATE(obj_desc->buffer.length);
+		table_desc.pointer = ACPI_ALLOCATE(length);
 		if (!table_desc.pointer) {
 			return_ACPI_STATUS(AE_NO_MEMORY);
 		}
 
 		ACPI_MEMCPY(table_desc.pointer, obj_desc->buffer.pointer,
-			    obj_desc->buffer.length);
-		table_desc.length = obj_desc->buffer.length;
+			    length);
+		table_desc.length = length;
 		table_desc.flags = ACPI_TABLE_ORIGIN_ALLOCATED;
 		break;
 
diff --git a/drivers/acpi/tables/tbutils.c b/drivers/acpi/tables/tbutils.c
index 010f19652f8..d04442fc495 100644
--- a/drivers/acpi/tables/tbutils.c
+++ b/drivers/acpi/tables/tbutils.c
@@ -212,7 +212,7 @@ acpi_status acpi_tb_verify_checksum(struct acpi_table_header *table, u32 length)
 
 	if (checksum) {
 		ACPI_WARNING((AE_INFO,
-			      "Incorrect checksum in table [%4.4s] -  %2.2X, should be %2.2X",
+			      "Incorrect checksum in table [%4.4s] - %2.2X, should be %2.2X",
 			      table->signature, table->checksum,
 			      (u8) (table->checksum - checksum)));