[PATCH] off-by-1 in kernel/power/main.c
authordean gaudet <dean@arctic.org>
Fri, 28 Apr 2006 01:39:17 +0000 (18:39 -0700)
committerLinus Torvalds <torvalds@g5.osdl.org>
Fri, 28 Apr 2006 15:33:46 +0000 (08:33 -0700)
There's an off-by-1 in kernel/power/main.c:state_store() ...  if your
kernel just happens to have some non-zero data at pm_states[PM_SUSPEND_MAX]
(i.e.  one past the end of the array) then it'll let you write anything you
want to /sys/power/state and in response the box will enter S5.

Signed-off-by: dean gaudet <dean@arctic.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
kernel/power/main.c

index ee371f50ccaae6fc183f988ff92215df87a03064..a6d9ef46009ebdcb37f5b8fc4287d81f02dd089a 100644 (file)
@@ -272,7 +272,7 @@ static ssize_t state_store(struct subsystem * subsys, const char * buf, size_t n
                if (*s && !strncmp(buf, *s, len))
                        break;
        }
-       if (*s)
+       if (state < PM_SUSPEND_MAX && *s)
                error = enter_state(state);
        else
                error = -EINVAL;