linux-kernel - [PATCH] ACPICA: proactively check null ptr to avoid API misuse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220216062615.779778-1-ztong0001@gmail.com>
Date:   Tue, 15 Feb 2022 22:26:15 -0800
From:   Tong Zhang <ztong0001@...il.com>
To:     Robert Moore <robert.moore@...el.com>,
        "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
        Len Brown <lenb@...nel.org>, linux-acpi@...r.kernel.org,
        devel@...ica.org, linux-kernel@...r.kernel.org
Cc:     Tong Zhang <ztong0001@...il.com>
Subject: [PATCH] ACPICA: proactively check null ptr to avoid API misuse

There are some cases that user use acpi_ns_walk_namespace() without
checking acpi_disable flag. When acpi=off is provided in boot cmdline,
acpi_gbl_root_node is NULL and calling acpi_ns_walk_namespace() will
crash kernel. In order to avoid such misuse, we proactively check null ptr
and return an error when we know ACPI is disabled.

Signed-off-by: Tong Zhang <ztong0001@...il.com>
---
 drivers/acpi/acpica/nswalk.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c
index 915c2433463d..9ae45db16d86 100644
--- a/drivers/acpi/acpica/nswalk.c
+++ b/drivers/acpi/acpica/nswalk.c
@@ -171,6 +171,13 @@ acpi_ns_walk_namespace(acpi_object_type type,
 		start_node = acpi_gbl_root_node;
 	}
 
+	/* acpi_gbl_root_node is NULL when acpi=off is provided.
+	 * We proactively check nulliness here and return an error if user call
+	 * this function without checking acpi_disabled
+	 */
+	if (start_node == NULL)
+		return_ACPI_STATUS(AE_ERROR);
+
 	/* Null child means "get first node" */
 
 	parent_node = start_node;
-- 
2.25.1