freebsd-skq/sys/dev/acpica
jkim 01c69422a0 Fix a use-after-free bug for extended IRQ resource[1]. When _PRS buffer is
copied as a template for _SRS, a string pointer for descriptor name is also
copied and it becomes stale as soon as it gets de-allocated[2].  Now _CRS is
used as a template for _SRS as ACPI specification suggests if it is usable.
The template from _PRS is still utilized but only when _CRS is not available
or broken.  To avoid use-after-free the problem in this case, however, only
mandatory fields are copied, optional data is removed, and structure length
is adjusted accordingly.

Reported by:	hps[1]
Analyzed by:	avg[2]
Tested by:	hps
2010-11-05 19:50:09 +00:00
..
Osd Clean up unused headers. 2010-10-13 17:06:25 +00:00
acpi_acad.c Do not hold the ACPI A/C adapter lock when changing the power profile. 2009-09-30 17:07:49 +00:00
acpi_battery.c Temporarily revert the new-bus locking for 8.0 release. It will be 2009-08-20 19:17:53 +00:00
acpi_button.c Merge ACPICA 20100702. 2010-07-06 20:57:28 +00:00
acpi_cmbat.c Import ACPICA 20090521. 2009-06-05 18:44:36 +00:00
acpi_cpu.c Quick fix for unmotivated C2 state usage during boot, introduced at r212541. 2010-09-22 11:32:22 +00:00
acpi_dock.c Remove unused assignment. 2010-06-11 19:53:42 +00:00
acpi_ec.c acpi_ec: changes in communication with hardware 2010-10-12 17:53:01 +00:00
acpi_hpet.c Do not use regular interrupts on NVidia HPETs. NVidia MCP5x chipsets have 2010-09-30 16:23:01 +00:00
acpi_hpet.h Implement new event timers infrastructure. It provides unified APIs for 2010-06-20 21:33:29 +00:00
acpi_if.m Remove PCI_SET_POWERSTATE method from acpi.c and eradicate all PCI-specific 2010-10-19 19:53:06 +00:00
acpi_isab.c Import ACPICA 20090521. 2009-06-05 18:44:36 +00:00
acpi_lid.c Merge ACPICA 20100702. 2010-07-06 20:57:28 +00:00
acpi_package.c Merge ACPICA 20100121. 2010-01-21 21:14:28 +00:00
acpi_pci_link.c Fix a use-after-free bug for extended IRQ resource[1]. When _PRS buffer is 2010-11-05 19:50:09 +00:00
acpi_pci.c Introduce a new tunable 'hw.pci.do_power_suspend'. This tunable lets you 2010-10-20 16:47:09 +00:00
acpi_pcib_acpi.c Add a new method to the PCI bridge interface, PCIB_POWER_FOR_SLEEP(). This 2010-08-17 15:44:52 +00:00
acpi_pcib_pci.c Add a new method to the PCI bridge interface, PCIB_POWER_FOR_SLEEP(). This 2010-08-17 15:44:52 +00:00
acpi_pcib.c Add a new method to the PCI bridge interface, PCIB_POWER_FOR_SLEEP(). This 2010-08-17 15:44:52 +00:00
acpi_pcibvar.h Add a new method to the PCI bridge interface, PCIB_POWER_FOR_SLEEP(). This 2010-08-17 15:44:52 +00:00
acpi_perf.c Import ACPICA 20090521. 2009-06-05 18:44:36 +00:00
acpi_powerres.c Merge ACPICA 20100121. 2010-01-21 21:14:28 +00:00
acpi_quirk.c Import ACPICA 20090521. 2009-06-05 18:44:36 +00:00
acpi_quirks
acpi_resource.c Import ACPICA 20090521. 2009-06-05 18:44:36 +00:00
acpi_smbat.c Merge ACPICA 20100121. 2010-01-21 21:14:28 +00:00
acpi_smbus.h
acpi_thermal.c fix a few cases where a string is passed via format argument instead of 2010-06-11 19:27:21 +00:00
acpi_throttle.c Import ACPICA 20090521. 2009-06-05 18:44:36 +00:00
acpi_timer.c Import ACPICA 20090521. 2009-06-05 18:44:36 +00:00
acpi_video.c Simplify a function for getting brightness levels. 2010-06-11 19:58:41 +00:00
acpi.c Adjust a comment to clarify why \_SB_ and \_TZ_ are defined as device type 2010-11-03 23:16:35 +00:00
acpiio.h
acpivar.h Add a new method to the PCI bridge interface, PCIB_POWER_FOR_SLEEP(). This 2010-08-17 15:44:52 +00:00