linux-kernel - [PATCH] ACPICA: add more parameter validation for acpi_walk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250815-acpi_fix-v1-1-a05ebfe1b8ac@uniontech.com>
Date: Fri, 15 Aug 2025 16:56:39 +0800
From: Cryolitia PukNgae via B4 Relay <devnull+cryolitia.uniontech.com@...nel.org>
To: "Rafael J. Wysocki" <rafael@...nel.org>, 
 Robert Moore <robert.moore@...el.com>, Len Brown <lenb@...nel.org>
Cc: linux-acpi@...r.kernel.org, acpica-devel@...ts.linux.dev, 
 linux-kernel@...r.kernel.org, wangyuli@...ontech.com, 
 guanwentao@...ontech.com, niecheng1@...ontech.com, zhanjun@...ontech.com, 
 Cryolitia PukNgae <cryolitia@...ontech.com>
Subject: [PATCH] ACPICA: add more parameter validation for
 acpi_walk_namespace()

From: Cryolitia PukNgae <cryolitia@...ontech.com>

On the Honor FMB-P-PCB laptop, an incorrect ACPI table causes
sdw_intel_acpi_scan to pass a NULL pointer as start_object to
acpi_walk_namespace() when calling it, which eventually causes the
kernel to report a NULL pointer dereference[1].

1. https://gist.github.com/Cryolitia/a860ffc97437dcd2cd988371d5b73ed7

Signed-off-by: Cryolitia PukNgae <cryolitia@...ontech.com>
---
 drivers/acpi/acpica/nsxfeval.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
index f9d059647cc52e94ce013af3382addba338820e8..c1f318ea7d5fcd846dc158b155286a6f5bba4cff 100644
--- a/drivers/acpi/acpica/nsxfeval.c
+++ b/drivers/acpi/acpica/nsxfeval.c
@@ -564,7 +564,7 @@ acpi_walk_namespace(acpi_object_type type,

 	/* Parameter validation */

-	if ((type > ACPI_TYPE_LOCAL_MAX) ||
+	if ((type > ACPI_TYPE_LOCAL_MAX) || (start_object == NULL) ||
 	    (!max_depth) || (!descending_callback && !ascending_callback)) {
 		return_ACPI_STATUS(AE_BAD_PARAMETER);
 	}

---
base-commit: 24ea63ea387714634813359e2c8e0e6c36952f73
change-id: 20250815-acpi_fix-3724e6c4da02

Best regards,
-- 
Cryolitia PukNgae <cryolitia@...ontech.com>