From patchwork Mon Nov 7 17:42:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Rafael J. Wysocki" X-Patchwork-Id: 16590 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp2200072wru; Mon, 7 Nov 2022 09:52:52 -0800 (PST) X-Google-Smtp-Source: AMsMyM4oijf/51p9+rGgERrFLAwDYFt80YAbK/mOU10e3S6eVUxMy9W3CdkmUwsszGYd3h5BHVxL X-Received: by 2002:a17:90b:3e83:b0:212:de17:952c with SMTP id rj3-20020a17090b3e8300b00212de17952cmr51684359pjb.102.1667843572368; Mon, 07 Nov 2022 09:52:52 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1667843572; cv=none; d=google.com; s=arc-20160816; b=UQSvtBYENda0HJJK0FbTWyhdrPG6/kaySTcpXKHl4695deWriD1KbQX+wvLQ0yLdQo XOP0XdwgXyO3/fsTC0JxtsuUyVNremsCWAf1HbKy1DP+M9nUdOtsJySDNyFJllDmRQso qHDUyofqGKVYf/JRrLsuqtDPQfZmpGGgMTYeAHv0p6eQjqQkJbWfYyJNVW9faVbjRqpE Y0VEpPSG4VuenTyI9C5cdhVFJuk+llbeFx1x7x2JBxZuIk2VtGqsQPuEEuK5TJqILFr8 yEmxyfokBG22K7B2JAVzjRytCiBo+0LKxgkMrG7ikS6UeFCslDWeWkgjg5uk8CqmRRHF iwEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=+UnPEombRM4bFHsehp/hCd9FFfeHpW+f73e4iMMVafs=; b=rtZJemfe7q52or0uhGfrgJomym5SzUkcIRf2kmPH/YZs44+otwLlPJzESeS5/tI12x dyYy8K4t4Wg89L87HthiYUUKeoDM9hiB8YSOtue/A81AcnEsWi7hDTLOcS2t1ScG4dDj Q1uWXduUNwOJKtdJG+VM8eG61ccHtnpaXM3UWFsDMhqH2y937/KZZYQmvxrAduzQ7/o9 xHjC2noO4C0DM/Kw1tn/pJShm8ZmCsc6tGWMaqjtMAh0INJTEw1aP4HHCd9EnEuMTdg9 4Bp9i1YBd1bYGaP2dY15134yCf6N6AO5hucU2ZNC8li7myCv5qsktLZXVmXlcS6+JNmc OOlA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t41-20020a056a0013a900b0056cd93aac47si11531092pfg.358.2022.11.07.09.52.25; Mon, 07 Nov 2022 09:52:52 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232476AbiKGRmq (ORCPT + 99 others); Mon, 7 Nov 2022 12:42:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51924 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231403AbiKGRmp (ORCPT ); Mon, 7 Nov 2022 12:42:45 -0500 Received: from cloudserver094114.home.pl (cloudserver094114.home.pl [79.96.170.134]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 583B41A383; Mon, 7 Nov 2022 09:42:43 -0800 (PST) Received: from localhost (127.0.0.1) (HELO v370.home.net.pl) by /usr/run/smtp (/usr/run/postfix/private/idea_relay_lmtp) via UNIX with SMTP (IdeaSmtpServer 5.0.0) id 4ff0f43161b321cf; Mon, 7 Nov 2022 18:42:40 +0100 Received: from kreacher.localnet (unknown [213.134.188.205]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by v370.home.net.pl (Postfix) with ESMTPSA id A7CCD66EB64; Mon, 7 Nov 2022 18:42:39 +0100 (CET) Authentication-Results: v370.home.net.pl; dmarc=none (p=none dis=none) header.from=rjwysocki.net Authentication-Results: v370.home.net.pl; spf=fail smtp.mailfrom=rjwysocki.net From: "Rafael J. Wysocki" To: Linux ACPI Cc: LKML , Bob Moore , Chen Zhongjin Subject: [PATCH] ACPICA: Fix error code path in acpi_ds_call_control_method() Date: Mon, 07 Nov 2022 18:42:36 +0100 Message-ID: <2669303.mvXUDI8C0e@kreacher> MIME-Version: 1.0 X-CLIENT-IP: 213.134.188.205 X-CLIENT-HOSTNAME: 213.134.188.205 X-VADE-SPAMSTATE: clean X-VADE-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedvgedrvdekgddutddvucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecujffqoffgrffnpdggtffipffknecuuegrihhlohhuthemucduhedtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjughrpefhvfevufffkfgggfgtsehtufertddttdejnecuhfhrohhmpedftfgrfhgrvghlucflrdcuhgihshhotghkihdfuceorhhjfiesrhhjfiihshhotghkihdrnhgvtheqnecuggftrfgrthhtvghrnhepgeffhfdujeelhfdtgeffkeetudfhtefhhfeiteethfekvefgvdfgfeeikeeigfehnecuffhomhgrihhnpehkvghrnhgvlhdrohhrghenucfkphepvddufedrudefgedrudekkedrvddtheenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpedvudefrddufeegrddukeekrddvtdehpdhhvghlohepkhhrvggrtghhvghrrdhlohgtrghlnhgvthdpmhgrihhlfhhrohhmpedftfgrfhgrvghlucflrdcuhgihshhotghkihdfuceorhhjfiesrhhjfiihshhotghkihdrnhgvtheqpdhnsggprhgtphhtthhopeegpdhrtghpthhtoheplhhinhhugidqrggtphhisehvghgvrhdrkhgvrhhnvghlrdhorhhgpdhrtghpthhtoheplhhinhhugidqkhgvrhhnvghlsehvghgvrhdrkhgvrhhnvghlrdhorhhgpdhrtghpthhtoheprhhosggvrhhtrdhmohhorhgvsehinhhtvghlrdgtohhmpdhrtghpthhtoheptghhvghniihhohhnghhj ihhnsehhuhgrfigvihdrtghomh X-DCC--Metrics: v370.home.net.pl 1024; Body=4 Fuz1=4 Fuz2=4 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1748860741971206726?= X-GMAIL-MSGID: =?utf-8?q?1748860741971206726?= From: Rafael J. Wysocki A use-after-free in acpi_ps_parse_aml() after a failing invocaion of acpi_ds_call_control_method() is reported by KASAN [1] and code inspection reveals that next_walk_state pushed to the thread by acpi_ds_create_walk_state() is freed on errors, but it is not popped from the thread beforehand. Thus acpi_ds_get_current_walk_state() called by acpi_ps_parse_aml() subsequently returns it as the new walk state which is incorrect. To address this, make acpi_ds_call_control_method() call acpi_ds_pop_walk_state() to pop next_walk_state from the thread before returning an error. Link: https://lore.kernel.org/linux-acpi/20221019073443.248215-1-chenzhongjin@huawei.com/ Reported-by: Chen Zhongjin Signed-off-by: Rafael J. Wysocki Reviewed-by: Chen Zhongjin --- drivers/acpi/acpica/dsmethod.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) Index: linux-pm/drivers/acpi/acpica/dsmethod.c =================================================================== --- linux-pm.orig/drivers/acpi/acpica/dsmethod.c +++ linux-pm/drivers/acpi/acpica/dsmethod.c @@ -517,7 +517,7 @@ acpi_ds_call_control_method(struct acpi_ info = ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_evaluate_info)); if (!info) { status = AE_NO_MEMORY; - goto cleanup; + goto pop_walk_state; } info->parameters = &this_walk_state->operands[0]; @@ -529,7 +529,7 @@ acpi_ds_call_control_method(struct acpi_ ACPI_FREE(info); if (ACPI_FAILURE(status)) { - goto cleanup; + goto pop_walk_state; } next_walk_state->method_nesting_depth = @@ -575,6 +575,12 @@ acpi_ds_call_control_method(struct acpi_ return_ACPI_STATUS(status); +pop_walk_state: + + /* On error, pop the walk state to be deleted from thread */ + + acpi_ds_pop_walk_state(thread); + cleanup: /* On error, we must terminate the method properly */