aboutsummaryrefslogtreecommitdiff
path: root/kernel/power/main.c
diff options
context:
space:
mode:
authordean gaudet <dean@arctic.org>2006-04-27 18:39:17 -0700
committerLinus Torvalds <torvalds@g5.osdl.org>2006-04-28 08:33:46 -0700
commit47bb789973fed504e4711ec34e63b84e6cbfb4e8 (patch)
tree2f617a73244a93d4b5b92236b6f809bf36912db5 /kernel/power/main.c
parent37e53db8aa233c65142d63b496277bf5be9c0ade (diff)
[PATCH] off-by-1 in kernel/power/main.c
There's an off-by-1 in kernel/power/main.c:state_store() ... if your kernel just happens to have some non-zero data at pm_states[PM_SUSPEND_MAX] (i.e. one past the end of the array) then it'll let you write anything you want to /sys/power/state and in response the box will enter S5. Signed-off-by: dean gaudet <dean@arctic.org> Acked-by: Pavel Machek <pavel@ucw.cz> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'kernel/power/main.c')
-rw-r--r--kernel/power/main.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/power/main.c b/kernel/power/main.c
index ee371f50cca..a6d9ef46009 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -272,7 +272,7 @@ static ssize_t state_store(struct subsystem * subsys, const char * buf, size_t n
if (*s && !strncmp(buf, *s, len))
break;
}
- if (*s)
+ if (state < PM_SUSPEND_MAX && *s)
error = enter_state(state);
else
error = -EINVAL;