[PATCH] off-by-1 in kernel/power/main.c

47bb7899 · dean gaudet <[email protected]> · 2006-04-27 18:39:17 -07:00

There's an off-by-1 in kernel/power/main.c:state_store() ...  if your
kernel just happens to have some non-zero data at pm_states[PM_SUSPEND_MAX]
(i.e.  one past the end of the array) then it'll let you write anything you
want to /sys/power/state and in response the box will enter S5.

Signed-off-by: dean gaudet <[email protected]>
Acked-by: Pavel Machek <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Commit: 47bb789973fed504e4711ec34e63b84e6cbfb4e8
Parents: 37e53db8

Changes

1 files changed · +1 −1

File	Status	Add	Del	Content
kernel/power/main.c	modified	+1	−1	View file

kernel/power/main.c

View file

diff --git a/kernel/power/main.c b/kernel/power/main.c
index ee371f5..a6d9ef4 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -272,7 +272,7 @@ static ssize_t state_store(struct subsystem * subsys, const char * buf, size_t n
 		if (*s && !strncmp(buf, *s, len))
 			break;
 	}
-	if (*s)
+	if (state < PM_SUSPEND_MAX && *s)
 		error = enter_state(state);
 	else
 		error = -EINVAL;