From: "Rafael J. Wysocki" <rafael@kernel.org>
To: Nikita Kiryushin <kiryushin@ancud.ru>
Cc: Robert Moore <robert.moore@intel.com>,
"Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
Len Brown <lenb@kernel.org>,
linux-acpi@vger.kernel.org, acpica-devel@lists.linux.dev,
linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org
Subject: Re: [PATCH v2] ACPICA: debugger: check status of acpi_evaluate_object in acpi_db_walk_for_fields
Date: Tue, 26 Mar 2024 13:07:54 +0100 [thread overview]
Message-ID: <CAJZ5v0gmO8_cosZ5j6iLRFaBEscxTGtfb5JTmnDeRqTOS-6-JQ@mail.gmail.com> (raw)
In-Reply-To: <20240322180753.5612-1-kiryushin@ancud.ru>
On Fri, Mar 22, 2024 at 7:23 PM Nikita Kiryushin <kiryushin@ancud.ru> wrote:
>
> ACPICA commit 9061cd9aa131205657c811a52a9f8325a040c6c9
>
> Errors in acpi_evaluate_object can lead to incorrect state of buffer.
> This can lead to access to data in previously ACPI_FREEd buffer and
> secondary ACPI_FREE to the same buffer later.
>
> Handle errors in acpi_evaluate_object the same way it is done earlier
> with acpi_ns_handle_to_pathname.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Link: https://github.com/acpica/acpica/commit/9061cd9a
> Fixes: 5fd033288a86 ("ACPICA: debugger: add command to dump all fields of particular subtype")
> Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
> ---
> v2: Add ACPICA project git links for corresponding changes
> drivers/acpi/acpica/dbnames.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/acpi/acpica/dbnames.c b/drivers/acpi/acpica/dbnames.c
> index b91155ea9c34..c9131259f717 100644
> --- a/drivers/acpi/acpica/dbnames.c
> +++ b/drivers/acpi/acpica/dbnames.c
> @@ -550,8 +550,12 @@ acpi_db_walk_for_fields(acpi_handle obj_handle,
> ACPI_FREE(buffer.pointer);
>
> buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER;
> - acpi_evaluate_object(obj_handle, NULL, NULL, &buffer);
> -
> + status = acpi_evaluate_object(obj_handle, NULL, NULL, &buffer);
> + if (ACPI_FAILURE(status)) {
> + acpi_os_printf("Could Not evaluate object %p\n",
> + obj_handle);
> + return (AE_OK);
> + }
> /*
> * Since this is a field unit, surround the output in braces
> */
> --
Applied as 6.10 material, thanks!
prev parent reply other threads:[~2024-03-26 12:08 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-13 13:15 [PATCH] ACPICA: debugger: check status of acpi_evaluate_object in acpi_db_walk_for_fields Nikita Kiryushin
2023-12-06 16:39 ` Rafael J. Wysocki
2024-03-22 18:07 ` [PATCH v2] " Nikita Kiryushin
2024-03-26 12:07 ` Rafael J. Wysocki [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAJZ5v0gmO8_cosZ5j6iLRFaBEscxTGtfb5JTmnDeRqTOS-6-JQ@mail.gmail.com \
--to=rafael@kernel.org \
--cc=acpica-devel@lists.linux.dev \
--cc=kiryushin@ancud.ru \
--cc=lenb@kernel.org \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lvc-project@linuxtesting.org \
--cc=rafael.j.wysocki@intel.com \
--cc=robert.moore@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).