| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CF6A88132359CE47947DB4C6E1709ED53C5AAB1C@ORSMSX122.amr.corp.intel.com>
Date: Wed, 8 May 2019 19:52:58 +0000
From: "Schmauss, Erik" <erik.schmauss@...el.com>
To: YueHaibing <yuehaibing@...wei.com>,
"Moore, Robert" <robert.moore@...el.com>,
"Wysocki, Rafael J" <rafael.j.wysocki@...el.com>,
"lenb@...nel.org" <lenb@...nel.org>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"devel@...ica.org" <devel@...ica.org>,
"linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>
Subject: RE: [PATCH] ACPICA: acpica: Fix possible NULL pointer dereference
in acpi_ut_remove_reference
> -----Original Message-----
> From: YueHaibing [mailto:yuehaibing@...wei.com]
> Sent: Wednesday, May 8, 2019 8:07 AM
> To: Moore, Robert <robert.moore@...el.com>; Schmauss, Erik
> <erik.schmauss@...el.com>; Wysocki, Rafael J <rafael.j.wysocki@...el.com>;
> lenb@...nel.org
> Cc: linux-kernel@...r.kernel.org; devel@...ica.org; linux-
> acpi@...r.kernel.org; YueHaibing <yuehaibing@...wei.com>
> Subject: [PATCH] ACPICA: acpica: Fix possible NULL pointer dereference in
> acpi_ut_remove_reference
>
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page PGD 0 P4D 0
> Oops: 0000 [#1
> CPU: 0 PID: 7393 Comm: modprobe Not tainted 5.1.0+ #34 Hardware name:
> QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-
> prebuilt.qemu-project.org 04/01/2014
> RIP: 0010:acpi_ut_update_object_reference+0xda/0x1e8
> Code: 4c 89 e7 eb ea 48 8b 7b 18 48 85 ff 0f 84 95 00 00 00 4c 8b 67 38 44 89 ee
> e8 dd fb ff ff 4c 89 e7 eb e6 48 8b 43 18 44 89 e2 <48> 8b 3c d0 48 85 ff 75 0b 41
> ff c4 44 3b 63 2c 72 e7 eb 66 8a 47
> RSP: 0018:ffffc90001c9f550 EFLAGS: 00010283
> RAX: 0000000000000000 RBX: ffff8882310d7288 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8882310d7288
> RBP: ffffc90001c9f580 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000001 R11: 000000003ef29b78 R12: 0000000000000000
> R13: 0000000000000001 R14: ffff88823122e000 R15: 0000000000000000
> FS: 00007f4469ead540(0000) GS:ffff888237a00000(0000)
> knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000000 CR3: 000000022c2b5000 CR4: 00000000000006f0 Call
> Trace:
> acpi_ut_remove_reference+0x29/0x2c
> acpi_ut_copy_iobject_to_iobject+0xd7/0xee
> acpi_ds_store_object_to_local+0x9a/0x181
> acpi_ex_store+0x233/0x279
> ? acpi_ds_create_operands+0x74/0xdb
> acpi_ex_opcode_1A_1T_1R+0x3c3/0x4fc
> acpi_ds_exec_end_op+0xd1/0x419
> acpi_ps_parse_loop+0x532/0x5d0
> acpi_ps_parse_aml+0x93/0x2c8
> acpi_ps_execute_method+0x16d/0x1b2
> acpi_ns_evaluate+0x1c1/0x26c
> acpi_ut_evaluate_object+0x7d/0x1a4
> acpi_rs_get_prt_method_data+0x30/0x66
> acpi_get_irq_routing_table+0x3d/0x56
> acpi_pci_irq_find_prt_entry+0x8d/0x300
> ? trace_hardirqs_on+0x3f/0x110
> acpi_pci_irq_lookup+0x35/0x1f0
> acpi_pci_irq_enable+0x72/0x1e0
> ? pci_read_config_word+0x2e/0x30
> pcibios_enable_device+0x2e/0x40
> do_pci_enable_device+0x5c/0x100
> pci_enable_device_flags+0xe0/0x130
> pci_enable_device+0xe/0x10
> e1000_probe+0xd2/0xfc0 [e1000
> ? trace_hardirqs_on+0x3f/0x110
> local_pci_probe+0x41/0x90
> pci_device_probe+0x14c/0x1b0
> really_probe+0x1d4/0x2d0
> driver_probe_device+0x50/0xf0
> device_driver_attach+0x54/0x60
> __driver_attach+0x7e/0xd0
> ? device_driver_attach+0x60/0x60
> bus_for_each_dev+0x68/0xc0
> driver_attach+0x19/0x20
> bus_add_driver+0x15e/0x200
> driver_register+0x5b/0xf0
> __pci_register_driver+0x66/0x70
> ? 0xffffffffa0179000
> e1000_init_module+0x50/0x1000 [e1000
> ? 0xffffffffa0179000
> do_one_initcall+0x6c/0x3cc
> ? do_init_module+0x22/0x207
> ? rcu_read_lock_sched_held+0x97/0xb0
> ? kmem_cache_alloc_trace+0x325/0x3b0
> do_init_module+0x5b/0x207
> load_module+0x1e34/0x2560
> ? m_show+0x1d0/0x1d0
> __do_sys_finit_module+0xc5/0xd0
> __x64_sys_finit_module+0x15/0x20
> do_syscall_64+0x6b/0x1d0
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> In acpi_ut_copy_iobject_to_iobject, if
> acpi_ut_copy_ipackage_to_ipackage failed with AE_NO_MEMORY,
> acpi_ut_remove_reference will be called and in which calls
> acpi_ut_update_object_reference, then it try to dereference 'object-
> >package.elements[i]'
> which trigger NULL pointer dereference.
>
> Reported-by: Hulk Robot <hulkci@...wei.com>
> Fixes: 8aa5e56eeb61 ("ACPICA: Utilities: Fix memory leak in
> acpi_ut_copy_iobject_to_iobject")
> Signed-off-by: YueHaibing <yuehaibing@...wei.com>
> ---
> drivers/acpi/acpica/utcopy.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c index
> 1fb8327..038d518 100644
> --- a/drivers/acpi/acpica/utcopy.c
> +++ b/drivers/acpi/acpica/utcopy.c
> @@ -895,7 +895,6 @@
>
> dest_obj->common.type = source_obj->common.type;
> dest_obj->common.flags = source_obj->common.flags;
> - dest_obj->package.count = source_obj->package.count;
>
> /*
> * Create the object array and walk the source package tree @@ -
> 909,6 +908,8 @@
> return_ACPI_STATUS(AE_NO_MEMORY);
> }
>
> + dest_obj->package.count = source_obj->package.count;
> +
> /*
> * Copy the package element-by-element by walking the package
> "tree".
> * This handles nested packages of arbitrary depth.
> --
> 1.8.3.1
>
Please provide the acpidump as well as the dmesg
Thanks,
Erik
Powered by blists - more mailing lists