linux-kernel - [PATCH] ACPICA: Avoid walking the Namespace if StartNode is NULL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251125-acpica-v1-1-99e63b1b25f8@linux.dev>
Date: Tue, 25 Nov 2025 16:14:38 +0800
From: Cryolitia PukNgae <cryolitia.pukngae@...ux.dev>
To: "Rafael J. Wysocki" <rafael@...nel.org>, 
 Robert Moore <robert.moore@...el.com>, Len Brown <lenb@...nel.org>
Cc: linux-acpi@...r.kernel.org, acpica-devel@...ts.linux.dev, 
 linux-kernel@...r.kernel.org, Mingcong Bai <jeffbai@...c.io>, 
 Kexy Biscuit <kexybiscuit@...c.io>, Wentao Guan <guanwentao@...ontech.com>, 
 zhanjun@...ontech.com, niecheng1@...ontech.com, 
 Cryolitia PukNgae <cryolitia@...pin.org>, 
 Cryolitia PukNgae <cryolitia.pukngae@...ux.dev>
Subject: [PATCH] ACPICA: Avoid walking the Namespace if StartNode is NULL

ACPICA commit 1c1b57b9eba4554cb132ee658dd942c0210ed20d

Since commit 0c9992315e73 ("ACPICA: Avoid walking the ACPI Namespace
if it is not there") fixed the situation that both StartNode and
AcpiGbl_RootNode is NULL. The Linux kernel mainline now still crashed
on Honor Magicbook 14 Pro[1]. Due to the access to the member of
ParentNode in AcpiNsGetNextNode, the NULL pointer dereference will
always happen, no matter whether the StartNode equals to the
ACPI_ROOT_OBJECT or not. So we move the check of StartNode being NULL
out of the if block.

Unfortunately, all the attempt to contact with Honor has failed, they
refused to provide any technical support for Linux. The bad DSDT
table's dump could be found on GitHub[2].

DMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025

1. https://gist.github.com/Cryolitia/a860ffc97437dcd2cd988371d5b73ed7
2. https://github.com/denis-bb/honor-fmb-p-dsdt

Signed-off-by: Cryolitia PukNgae <cryolitia@...pin.org>
Link: https://github.com/acpica/acpica/pull/1061
Signed-off-by: Cryolitia PukNgae <cryolitia.pukngae@...ux.dev>
---
 drivers/acpi/acpica/nswalk.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c
index a2ac06a26e92..5670ff5a43cd 100644
--- a/drivers/acpi/acpica/nswalk.c
+++ b/drivers/acpi/acpica/nswalk.c
@@ -169,9 +169,12 @@ acpi_ns_walk_namespace(acpi_object_type type,

 	if (start_node == ACPI_ROOT_OBJECT) {
 		start_node = acpi_gbl_root_node;
-		if (!start_node) {
-			return_ACPI_STATUS(AE_NO_NAMESPACE);
-		}
+	}
+
+	/* Avoid walking the namespace if the StartNode is NULL */
+
+	if (!start_node) {
+		return_ACPI_STATUS(AE_NO_NAMESPACE);
 	}

 	/* Null child means "get first node" */

---
base-commit: ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d
change-id: 20251125-acpica-efe5a5fc01d9

Best regards,
-- 
Cryolitia PukNgae <cryolitia.pukngae@...ux.dev>