ACPICA: add more parameter validation for acpi_walk_namespace()

[PATCH] ACPICA: add more parameter validation for acpi_walk_namespace()

Posted by Cryolitia PukNgae via B4 Relay 5 months, 3 weeks ago

From: Cryolitia PukNgae <cryolitia@uniontech.com>

On the Honor FMB-P-PCB laptop, an incorrect ACPI table causes
sdw_intel_acpi_scan to pass a NULL pointer as start_object to
acpi_walk_namespace() when calling it, which eventually causes the
kernel to report a NULL pointer dereference[1].

1. https://gist.github.com/Cryolitia/a860ffc97437dcd2cd988371d5b73ed7

Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
---
 drivers/acpi/acpica/nsxfeval.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
index f9d059647cc52e94ce013af3382addba338820e8..c1f318ea7d5fcd846dc158b155286a6f5bba4cff 100644
--- a/drivers/acpi/acpica/nsxfeval.c
+++ b/drivers/acpi/acpica/nsxfeval.c
@@ -564,7 +564,7 @@ acpi_walk_namespace(acpi_object_type type,
 
 	/* Parameter validation */
 
-	if ((type > ACPI_TYPE_LOCAL_MAX) ||
+	if ((type > ACPI_TYPE_LOCAL_MAX) || (start_object == NULL) ||
 	    (!max_depth) || (!descending_callback && !ascending_callback)) {
 		return_ACPI_STATUS(AE_BAD_PARAMETER);
 	}

---
base-commit: 24ea63ea387714634813359e2c8e0e6c36952f73
change-id: 20250815-acpi_fix-3724e6c4da02

Best regards,
-- 
Cryolitia PukNgae <cryolitia@uniontech.com>

Re: [PATCH] ACPICA: add more parameter validation for acpi_walk_namespace()

Posted by Rafael J. Wysocki 5 months, 2 weeks ago

On Fri, Aug 15, 2025 at 10:56 AM Cryolitia PukNgae via B4 Relay
<devnull+cryolitia.uniontech.com@kernel.org> wrote:
>
> From: Cryolitia PukNgae <cryolitia@uniontech.com>
>
> On the Honor FMB-P-PCB laptop, an incorrect ACPI table causes
> sdw_intel_acpi_scan to pass a NULL pointer as start_object to
> acpi_walk_namespace() when calling it, which eventually causes the
> kernel to report a NULL pointer dereference[1].
>
> 1. https://gist.github.com/Cryolitia/a860ffc97437dcd2cd988371d5b73ed7
>
> Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>

Please submit ACPICA changes to the upstream ACPICA project on GitHub
as pull requests.  Once they have been merged upstream, you can submit
a Linux patch based on the upstream one with a pointer to the
corresponding upstream commit.

Thanks!

> ---
>  drivers/acpi/acpica/nsxfeval.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
> index f9d059647cc52e94ce013af3382addba338820e8..c1f318ea7d5fcd846dc158b155286a6f5bba4cff 100644
> --- a/drivers/acpi/acpica/nsxfeval.c
> +++ b/drivers/acpi/acpica/nsxfeval.c
> @@ -564,7 +564,7 @@ acpi_walk_namespace(acpi_object_type type,
>
>         /* Parameter validation */
>
> -       if ((type > ACPI_TYPE_LOCAL_MAX) ||
> +       if ((type > ACPI_TYPE_LOCAL_MAX) || (start_object == NULL) ||
>             (!max_depth) || (!descending_callback && !ascending_callback)) {
>                 return_ACPI_STATUS(AE_BAD_PARAMETER);
>         }
>
> ---
> base-commit: 24ea63ea387714634813359e2c8e0e6c36952f73
> change-id: 20250815-acpi_fix-3724e6c4da02
>
> Best regards,
> --
> Cryolitia PukNgae <cryolitia@uniontech.com>
>
>

Re: [PATCH] ACPICA: add more parameter validation for acpi_walk_namespace()

Posted by Cryolitia PukNgae 5 months, 2 weeks ago

On 25/08/2025 23.00, Rafael J. Wysocki wrote:
> On Fri, Aug 15, 2025 at 10:56 AM Cryolitia PukNgae via B4 Relay
> <devnull+cryolitia.uniontech.com@kernel.org> wrote:
>> From: Cryolitia PukNgae <cryolitia@uniontech.com>
>>
>> On the Honor FMB-P-PCB laptop, an incorrect ACPI table causes
>> sdw_intel_acpi_scan to pass a NULL pointer as start_object to
>> acpi_walk_namespace() when calling it, which eventually causes the
>> kernel to report a NULL pointer dereference[1].
>>
>> 1. https://gist.github.com/Cryolitia/a860ffc97437dcd2cd988371d5b73ed7
>>
>> Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
> Please submit ACPICA changes to the upstream ACPICA project on GitHub
> as pull requests.  Once they have been merged upstream, you can submit
> a Linux patch based on the upstream one with a pointer to the
> corresponding upstream commit.

I couldn't find which upstream file in acpica on GitHub should be 
modified, to match my kernel patch, but I found that the upstream has 
already added this parameter verification[1], although the source code 
is in a different form.


1. 
https://github.com/acpica/acpica/commit/19d0e9560c76a9f56f214f2a9f145ebd89e8ed49#diff-4e61bde9966be8a3b82956db81c0dafb02a39ae7f92c18eef5bc1d2b57d34ff7

>
> Thanks!
>
>> ---
>>   drivers/acpi/acpica/nsxfeval.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
>> index f9d059647cc52e94ce013af3382addba338820e8..c1f318ea7d5fcd846dc158b155286a6f5bba4cff 100644
>> --- a/drivers/acpi/acpica/nsxfeval.c
>> +++ b/drivers/acpi/acpica/nsxfeval.c
>> @@ -564,7 +564,7 @@ acpi_walk_namespace(acpi_object_type type,
>>
>>          /* Parameter validation */
>>
>> -       if ((type > ACPI_TYPE_LOCAL_MAX) ||
>> +       if ((type > ACPI_TYPE_LOCAL_MAX) || (start_object == NULL) ||
>>              (!max_depth) || (!descending_callback && !ascending_callback)) {
>>                  return_ACPI_STATUS(AE_BAD_PARAMETER);
>>          }
>>
>> ---
>> base-commit: 24ea63ea387714634813359e2c8e0e6c36952f73
>> change-id: 20250815-acpi_fix-3724e6c4da02
>>
>> Best regards,
>> --
>> Cryolitia PukNgae <cryolitia@uniontech.com>
>>
>>