[PATCH] ACPI: processor: check the _CST register buffer length

[Kang Chen]

acpi_processor_evaluate_cst() casts the first buffer of each _CST
C-state package to struct acpi_power_register without checking
buffer.length.  A short buffer makes the driver read past the ACPI
allocation and use the resulting address and space_id, which can reach
acpi_processor_ffh_cstate_probe() and rdmsr().  The _LPI path already
performs this check.

Skip C-states whose register buffer is smaller than
struct acpi_power_register.

The check has been missing since before the current git history; the
initial git import is the earliest tree containing the code.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>
---
 drivers/acpi/acpi_processor.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index 5fbab54171b7..d77c90a243cf 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -903,6 +903,12 @@ int acpi_processor_evaluate_cst(acpi_handle handle, u32 cpu,
 			continue;
 		}
 
+		if (obj->buffer.length < sizeof(*reg)) {
+			acpi_handle_info(handle, "_CST C%d package element[0] buffer too small, skip...\n",
+					 i);
+			continue;
+		}
+
 		reg = (struct acpi_power_register *)obj->buffer.pointer;
 
 		obj = &element->package.elements[1];
-- 
2.34.1