DF-3794 / mcallctrl.c
/* Control for DF-3794: same ioctl with a VALID path -> copyinstr succeeds * -> args freed -> no leak. usage: mcallctrl [iters] */ #include <sys/types.h> #include <sys/ioctl.h> #include <fcntl.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include "acpi.h" #include <dev/acpica/acpiio.h> #include <dev/acpica/acpiio_mcall.h> int main(int argc, char **argv) { long iters = (argc > 1) ? atol(argv[1]) : 100000; int i, fd; struct acpi_mcall_ioctl_arg a; ACPI_OBJECT objs[2]; ACPI_OBJECT_LIST ol; static char path[] = "\\_SB_"; fd = open("/dev/acpi", O_RDWR); if (fd < 0) { perror("open"); return 1; } memset(&a, 0, sizeof(a)); objs[0].Type = ACPI_TYPE_INTEGER; objs[0].Integer.Value = 1; objs[1].Type = ACPI_TYPE_INTEGER; objs[1].Integer.Value = 2; ol.Count = 2; ol.Pointer = objs; a.args = ol; a.path = path; for (i = 0; i < iters; i++) ioctl(fd, ACPIIO_DO_MCALL, &a); printf("control: %ld iterations with valid path done\n", iters); close(fd); return 0; } |