[PATCH] range checking for sleep states sent to /proc/acpi/sleep

A range checking is missing in acpi_system_write_sleep() in kernel
2.4, and writing a large integer value to /proc/acpi/sleep will cause
an oops. I could reproduce one this way :

   # echo 0x800000 >/proc/acpi/sleep

Fix extracted from the PaX patch.

diff --git a/drivers/acpi/system.c b/drivers/acpi/system.c
index a1e018c..26f7b68 100644 (file)
--- a/drivers/acpi/system.c
+++ b/drivers/acpi/system.c
@@ -748,7 +748,7 @@ acpi_system_write_sleep (
        
        state = simple_strtoul(state_string, NULL, 0);
        
-       if (!system->states[state])
+       if (state >= ACPI_S_STATE_COUNT || !system->states[state])
                return_VALUE(-ENODEV);
 
        /*