linux-kernel - [PATCH] ACPICA: Fix pop_walk_state called after walk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20221107092122.110204-1-chenzhongjin@huawei.com>
Date:   Mon, 7 Nov 2022 17:21:22 +0800
From:   Chen Zhongjin <chenzhongjin@...wei.com>
To:     <linux-kernel@...r.kernel.org>, <linux-acpi@...r.kernel.org>,
        <devel@...ica.org>
CC:     <robert.moore@...el.com>, <rafael.j.wysocki@...el.com>,
        <lenb@...nel.org>, <chenzhongjin@...wei.com>
Subject: [PATCH] ACPICA: Fix pop_walk_state called after walk_state is deleted

In the previous fix patch acpi_ds_pop_walk_state() is called after
acpi_ds_delete_walk_state() in cleanup, so the problem is not fixed
because it is acpi_ds_pop_walk_state(NULL) called actually.

Also, when acpi_ds_create_walk_state() failed and next_walk_state is
NULL, it pops the normal walk_state_list and make the memory leaked.

Check if next_walk_state is NULL, and do pop_walk_state() before it is
deleted.

Fixes: 539663bb068f ("ACPICA: Fix use-after-free in acpi_ps_parse_aml()")
Signed-off-by: Chen Zhongjin <chenzhongjin@...wei.com>
---
 drivers/acpi/acpica/dsmethod.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 19da7fc73186..cb15c66d5aac 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -580,8 +580,9 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
 	/* On error, we must terminate the method properly */
 
 	acpi_ds_terminate_control_method(obj_desc, next_walk_state);
+	if (next_walk_state)
+		acpi_ds_pop_walk_state(thread);
 	acpi_ds_delete_walk_state(next_walk_state);
-	acpi_ds_pop_walk_state(thread);
 
 	return_ACPI_STATUS(status);
 }
-- 
2.17.1