ACPI / debugfs: Fix buffer overflows, double free
authorVasiliy Kulikov <segoon@openwall.com>
Sat, 19 Feb 2011 13:18:08 +0000 (14:18 +0100)
committerRafael J. Wysocki <rjw@sisk.pl>
Thu, 24 Feb 2011 18:59:06 +0000 (19:59 +0100)
commit2949ad50711cc161721cf788711722eeeca33764
treeaba75138e732b43cc2c92ee2f310a0b457c70ebd
parent2aa15890f3c191326678f1bd68af61ec6b8753ec
ACPI / debugfs: Fix buffer overflows, double free

File position is not controlled, it may lead to overwrites of arbitrary
kernel memory.  Also the code may kfree() the same pointer multiple
times.

One more flaw is still present: if multiple processes open the file then
all 3 static variables are shared, leading to various race conditions.
They should be moved to file->private_data.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com>
Reviewed-by: Eugene Teo <eugeneteo@kernel.org>
Cc: stable@kernel.org
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
drivers/acpi/debugfs.c