linux-kernel - Re: [PATCH] acpica: Fix double-free in acpi_ns_repair

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 6 Feb 2017 09:06:17 -0600
From:   Daniel Drake <drake@...lessm.com>
To:     João Paulo Rechi Vita <jprvita@...il.com>
Cc:     "Zheng, Lv" <lv.zheng@...el.com>,
        "Moore, Robert" <robert.moore@...el.com>,
        "Wysocki, Rafael J" <rafael.j.wysocki@...el.com>,
        Len Brown <lenb@...nel.org>, Lin Ming <ming.m.lin@...el.com>,
        "linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>,
        "devel@...ica.org" <devel@...ica.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux@...lessm.com" <linux@...lessm.com>,
        "Jo?o Paulo Rechi Vita" <jprvita@...lessm.com>,
        "Box, David E" <david.e.box@...el.com>,
        "Schmauss, Erik" <erik.schmauss@...el.com>
Subject: Re: [PATCH] acpica: Fix double-free in acpi_ns_repair_CID()

On Mon, Feb 6, 2017 at 8:46 AM, João Paulo Rechi Vita <jprvita@...il.com> wrote:
> Yes, the real problem is i2c_hid not being probed for the touchpad
> device on this platform

The lack of probe was because when i2c_acpi_add_device() called
acpi_bus_get_device() on the handle for the touchpad device (TPL1), it
was returning the acpi_device for something totally unrelated.

We checked that the original handle-to-device mapping was set up
correctly before that point, hence this looks like memory corruption,
and the problem went away as soon as we fixed the double free.

> [    0.317002] ACPI Warning: Obj ffffa00472a445e8, Reference Count is
> already zero, cannot decrement
> [    0.317178]  (20160422/utdelete-442)
>
>> See this bug for reference:
>> https://bugs.acpica.org/show_bug.cgi?id=1336
>>
>
> Looks like it could be the same problem, indeed. I'm attaching a
> kernel log with acpi.trace_debug_layer=0x10091
> acpi.trace_debug_level=0x107FFF
> acpi.trace_method_name=_SB.PCI0.I2C1.TPL1._CID
> acpi.trace_state=opcode, which is what I was using to investigate the
> problem

The debug messages in that log stop when the method execution
completes, so it may also be useful to share a part of an earlier log
where you can see the double freeing happen in a bit more detail. For
each of the 2 objects double-freed below we confirmed that the first
unreference is the one in acpi_ns_repair_HID and the second
unreference is the one removed in JP's patch.

nsprepkg-0105 ns_check_package      : \_SB.PCI0.I2C1.TPL1._CID
Validating return Package of Type 2, Count 2
utobject-0404 ut_allocate_object_des: ffff940f6ba36480 Size 48
utdelete-0750 ut_remove_reference   : Obj ffff940f6ba36cf0 Current
Refs=1 [To Be Decremented]
utdelete-0447 ut_update_ref_count   : Obj ffff940f6ba36cf0 Type 02
Refs 00 [Decremented]
utdelete-0096 ut_delete_internal_obj: **** String ffff940f6ba36cf0,
ptr ffff9f654004e2a8
utdelete-0336 ut_delete_internal_obj: Deleting Object ffff940f6ba36cf0 [String]
utdelete-0750 ut_remove_reference   : Obj ffff940f6ba36cf0 Current
Refs=0 [To Be Decremented]
ACPI Warning: Obj ffff940f6ba36cf0, Reference Count is already zero,
cannot decrement
(20160422/utdelete-442)
utdelete-0447 ut_update_ref_count   : Obj ffff940f6ba36cf0 Type 02
Refs 00 [Decremented]
utdelete-0096 ut_delete_internal_obj: **** String ffff940f6ba36cf0,
ptr ffff9f654004e2a8
utdelete-0336 ut_delete_internal_obj: Deleting Object ffff940f6ba36cf0 [String]
utobject-0404 ut_allocate_object_des: ffff940f6ba36cf0 Size 48
utdelete-0750 ut_remove_reference   : Obj ffff940f6ba36c60 Current
Refs=1 [To Be Decremented]
utdelete-0447 ut_update_ref_count   : Obj ffff940f6ba36c60 Type 02
Refs 00 [Decremented]
utdelete-0096 ut_delete_internal_obj: **** String ffff940f6ba36c60,
ptr ffff9f654004e2b2
utdelete-0336 ut_delete_internal_obj: Deleting Object ffff940f6ba36c60 [String]
utdelete-0750 ut_remove_reference   : Obj ffff940f6ba36c60 Current
Refs=0 [To Be Decremented]
ACPI Warning: Obj ffff940f6ba36c60, Reference Count is already zero,
cannot decrement
(20160422/utdelete-442)
utdelete-0447 ut_update_ref_count   : Obj ffff940f6ba36c60 Type 02
Refs 00 [Decremented]
utdelete-0096 ut_delete_internal_obj: **** String ffff940f6ba36c60,
ptr ffff9f654004e2b2
utdelete-0336 ut_delete_internal_obj: Deleting Object ffff940f6ba36c60 [String]
  nseval-0315 ns_evaluate           : *** Completed evaluation of
object _CID ***

Thanks,
Daniel