linux-kernel - acpi_get_devices() crash when acpi_disabled==true (was [PATCH v2] drm/privacy-screen: honor acpi=off in detect_thinkpad_privacy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6a0233cd-d931-8a36-3b9e-08b774cec7b0@redhat.com>
Date:   Wed, 26 Jan 2022 14:47:24 +0100
From:   Hans de Goede <hdegoede@...hat.com>
To:     Tong Zhang <ztong0001@...il.com>,
        Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
        Maxime Ripard <mripard@...nel.org>,
        Thomas Zimmermann <tzimmermann@...e.de>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        "Rafael J. Wysocki" <rjw@...ysocki.net>,
        linux-acpi <linux-acpi@...r.kernel.org>
Subject: acpi_get_devices() crash when acpi_disabled==true (was [PATCH v2]
 drm/privacy-screen: honor acpi=off in detect_thinkpad_privacy_screen)

Hi All,

On 1/23/22 10:10, Tong Zhang wrote:
> when acpi=off is provided in bootarg, kernel crash with
> 
> [    1.252739] BUG: kernel NULL pointer dereference, address: 0000000000000018
> [    1.258308] Call Trace:
> [    1.258490]  ? acpi_walk_namespace+0x147/0x147
> [    1.258770]  acpi_get_devices+0xe4/0x137
> [    1.258921]  ? drm_core_init+0xc0/0xc0 [drm]
> [    1.259108]  detect_thinkpad_privacy_screen+0x5e/0xa8 [drm]
> [    1.259337]  drm_privacy_screen_lookup_init+0xe/0xe85 [drm]
> 
> The reason is that acpi_walk_namespace expects acpi related stuff
> initialized but in fact it wouldn't when acpi is set to off. In this case
> we should honor acpi=off in detect_thinkpad_privacy_screen().
> 
> Signed-off-by: Tong Zhang <ztong0001@...il.com>

Thank you for catching this and thank you for your patch. I was about to merge
this, but then I realized that this might not be the best way to fix this.

A quick grep shows 10 acpi_get_devices() calls outside of drivers/acpi,
and at a first glance about half of those are missing an acpi_disabled
check. IMHO it would be better to simply add an acpi_disabled check to
acpi_get_devices() itself.

Rafael, do you agree ?


Note the just added chrome privacy-screen check uses
acpi_dev_present(), this is also used in about 10 places outside
of drivers/acpi and AFAIK none of those do an acpi_disabled check.

acpi_dev_present() uses bus_find_device(&acpi_bus_type, ...)
but the acpi_bus_type does not get registered when acpi_disabled
is set. In the end this is fine though since bus_find_device
checks for the bus not being registered and then just returns
NULL.

Regards,

Hans




> ---
> v2: fix typo in previous commit -- my keyboard is eating letters 
> 
>  drivers/gpu/drm/drm_privacy_screen_x86.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpu/drm/drm_privacy_screen_x86.c b/drivers/gpu/drm/drm_privacy_screen_x86.c
> index a2cafb294ca6..e7aa74ad0b24 100644
> --- a/drivers/gpu/drm/drm_privacy_screen_x86.c
> +++ b/drivers/gpu/drm/drm_privacy_screen_x86.c
> @@ -33,6 +33,9 @@ static bool __init detect_thinkpad_privacy_screen(void)
>  	unsigned long long output;
>  	acpi_status status;
>  
> +	if (acpi_disabled)
> +		return false;
> +
>  	/* Get embedded-controller handle */
>  	status = acpi_get_devices("PNP0C09", acpi_set_handle, NULL, &ec_handle);
>  	if (ACPI_FAILURE(status) || !ec_handle)