Message ID | b8c5f018-4883-4c14-84ab-0514edac2770@ancud.ru |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b909:0:b0:403:3b70:6f57 with SMTP id t9csp1192819vqg; Mon, 13 Nov 2023 05:15:55 -0800 (PST) X-Google-Smtp-Source: AGHT+IFrdTFWAo4vXW0D7Af7V3l3R73GvjJN0sPWBfLmDdCJ7vh8ciyYgnl91C+foxrowWMPFFrC X-Received: by 2002:a05:6a20:d90b:b0:14c:c511:387d with SMTP id jd11-20020a056a20d90b00b0014cc511387dmr4706847pzb.9.1699881355316; Mon, 13 Nov 2023 05:15:55 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1699881355; cv=none; d=google.com; s=arc-20160816; b=A0BLdAXA/obdU4wQp+WcAVF98R0GsircdMjypHZYXB5KhBOpZomfh9Pty8mSvxHgzH jVuUe/+e+NzjyeyNgWNSWDAI4DjR/HoJfJwfaase4o8cKswxpgX3hOuMwfGh0Ggns2AE pRSEDRfNqzVxpkxPqFgCoaYIY7eksDeh6KDN2a64VAr773P8azpidXzjRQHV9hHYBMwH Sgrd3qhSsh1CbIBUqGCqwwlvmmCPRX/HXe9u0YACU7yQNxRR7U4AxAQDHyWglg0eGsiO XsDgFpFKfGBxhL1Xdhg+2Wq19yh+J/25610uy+Wyi6IeCBaGbU/iuigELvK35YDFbJFV 6NDg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:content-language:cc:to :subject:from:user-agent:mime-version:date:message-id; bh=E6WomfNCEI8RR9qDbvdP9vVV/sIbkxuUrtkOawJqN0M=; fh=QmnjOkyXrpt4mKByqJL07ERl6wMPvujPT0h7HH6CRe4=; b=YR6BBzxEhw347FyCQB6k69OCUVaLKJHe0hFkwJE3IS2/IBGdmSIyhYi6+PomTfePKP e4XAg4J5IRDMSGjRdipsTcztFvrXgDEg7r36PNttYB3tkqmejfy0Syh7pkoYI1Hd7MsM JWKt685EZFrOKcqZA5yNNtRX5AooqN4pD47YOVuXhLoIC+FIjN96Rhji3HsJhznNEnJN NErH+12QismvRJG7mOka8Iwv7MDaCKGkD3dLWet5ubu/WEauRI32sE1kJr6qQ6rrmlAE bY7q9r1AZfeVWbm9qmAwX6VJUEQ+9w7vSc7h56pLTPq1crTf7LNaX6cxa4QITd6mPhOl 8S0w== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from lipwig.vger.email (lipwig.vger.email. [2620:137:e000::3:3]) by mx.google.com with ESMTPS id o16-20020a170902d4d000b001c33d33975esi6339541plg.133.2023.11.13.05.15.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Nov 2023 05:15:55 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) client-ip=2620:137:e000::3:3; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id 1118580A1396; Mon, 13 Nov 2023 05:15:53 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229981AbjKMNP2 (ORCPT <rfc822;heyuhang3455@gmail.com> + 29 others); Mon, 13 Nov 2023 08:15:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58840 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229791AbjKMNP0 (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Mon, 13 Nov 2023 08:15:26 -0500 Received: from relay161.nicmail.ru (relay161.nicmail.ru [91.189.117.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 86755D6C; Mon, 13 Nov 2023 05:15:17 -0800 (PST) Received: from [10.28.138.149] (port=17042 helo=[192.168.95.111]) by relay.hosting.mail.nic.ru with esmtp (Exim 5.55) (envelope-from <kiryushin@ancud.ru>) id 1r2WmW-0000gj-5s; Mon, 13 Nov 2023 16:15:13 +0300 Received: from [87.245.155.195] (account kiryushin@ancud.ru HELO [192.168.95.111]) by incarp1102.mail.hosting.nic.ru (Exim 5.55) with id 1r2WmW-00A2aA-2O; Mon, 13 Nov 2023 16:15:12 +0300 Message-ID: <b8c5f018-4883-4c14-84ab-0514edac2770@ancud.ru> Date: Mon, 13 Nov 2023 16:15:11 +0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird From: Nikita Kiryushin <kiryushin@ancud.ru> Subject: [PATCH] ACPICA: debugger: check status of acpi_evaluate_object in acpi_db_walk_for_fields To: Robert Moore <robert.moore@intel.com> Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>, Len Brown <lenb@kernel.org>, Erik Kaneda <erik.kaneda@intel.com>, linux-acpi@vger.kernel.org, acpica-devel@lists.linux.dev, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-MS-Exchange-Organization-SCL: -1 X-Spam-Status: No, score=-0.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Mon, 13 Nov 2023 05:15:53 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1782454792059857858 X-GMAIL-MSGID: 1782454792059857858 |
Series |
ACPICA: debugger: check status of acpi_evaluate_object in acpi_db_walk_for_fields
|
|
Commit Message
Nikita Kiryushin
Nov. 13, 2023, 1:15 p.m. UTC
Errors in acpi_evaluate_object can lead to incorrect state of buffer.
This can lead to access to data in previously ACPI_FREEd buffer and
secondary ACPI_FREE to the same buffer later.
Handle errors in acpi_evaluate_object the same way it is done earlier
with acpi_ns_handle_to_pathname.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 5fd033288a86 ("ACPICA: debugger: add command to dump all fields
of particular subtype")
Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
---
drivers/acpi/acpica/dbnames.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
Comments
On Mon, Nov 13, 2023 at 2:33 PM Nikita Kiryushin <kiryushin@ancud.ru> wrote: > > Errors in acpi_evaluate_object can lead to incorrect state of buffer. > This can lead to access to data in previously ACPI_FREEd buffer and > secondary ACPI_FREE to the same buffer later. > > Handle errors in acpi_evaluate_object the same way it is done earlier > with acpi_ns_handle_to_pathname. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 5fd033288a86 ("ACPICA: debugger: add command to dump all fields > of particular subtype") > Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru> > --- > drivers/acpi/acpica/dbnames.c | 8 ++++++-- This is ACPICA code which comes from a separate project. The way to change it is to submit a pull request with the desired change to the upstream ACPICA project on GitHub and add a Link tag pointing to the upstream PR to the corresponding Linux patch. Then, the Linux patch can only be applied after the corresponding upstream PR has been merged. Thanks! > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/acpi/acpica/dbnames.c b/drivers/acpi/acpica/dbnames.c > index b91155ea9c34..c9131259f717 100644 > --- a/drivers/acpi/acpica/dbnames.c > +++ b/drivers/acpi/acpica/dbnames.c > @@ -550,8 +550,12 @@ acpi_db_walk_for_fields(acpi_handle obj_handle, > ACPI_FREE(buffer.pointer); > buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER; > - acpi_evaluate_object(obj_handle, NULL, NULL, &buffer); > - > + status = acpi_evaluate_object(obj_handle, NULL, NULL, &buffer); > + if (ACPI_FAILURE(status)) { > + acpi_os_printf("Could Not evaluate object %p\n", > + obj_handle); > + return (AE_OK); > + } > /* > * Since this is a field unit, surround the output in braces > */ > -- > 2.34.1 > >
diff --git a/drivers/acpi/acpica/dbnames.c b/drivers/acpi/acpica/dbnames.c index b91155ea9c34..c9131259f717 100644 --- a/drivers/acpi/acpica/dbnames.c +++ b/drivers/acpi/acpica/dbnames.c @@ -550,8 +550,12 @@ acpi_db_walk_for_fields(acpi_handle obj_handle, ACPI_FREE(buffer.pointer); buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER; - acpi_evaluate_object(obj_handle, NULL, NULL, &buffer); - + status = acpi_evaluate_object(obj_handle, NULL, NULL, &buffer); + if (ACPI_FAILURE(status)) { + acpi_os_printf("Could Not evaluate object %p\n", + obj_handle); + return (AE_OK); + } /* * Since this is a field unit, surround the output in braces */ -- 2.34.1