linux-kernel - [PATCH] exstore.c/exoparg.c: Add null-check on return

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251211122725.987-1-markov.gi@npc-ksb.ru>
Date: Thu, 11 Dec 2025 15:27:24 +0300
From: Markov Gleb <markov.gi@...-ksb.ru>
To: "Rafael J. Wysocki" <rafael@...nel.org>
Cc: Markov Gleb <markov.gi@...-ksb.ru>,
	Robert Moore <robert.moore@...el.com>,
	Len Brown <lenb@...nel.org>,
	linux-acpi@...r.kernel.org,
	acpica-devel@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	ldv-project@...uxtesting.org
Subject: [PATCH] exstore.c/exoparg.c: Add null-check on return_desc->pointer use.

If the requested length is == 0,
then the length variable will be set to == 0.

Call of acpi_ex_opcode_3A_1T_1R in exoparg3.c
with length == 0 may lead a skip of code block
with buffer initialization so usage of any
buffer fields will lead to dereference of null.

The problem occurs when calling acpi_ex_store
with return_desc as the first parameter.

Added null check to exstore.c to avoid
dereferencing.
Make status change on uninitialized buffer.
If the solution is trivial, this section can be omitted.
Not tried to initialize the buffer again.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Markov Gleb <markov.gi@...-ksb.ru>
---
 drivers/acpi/acpica/exstore.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/acpi/acpica/exstore.c b/drivers/acpi/acpica/exstore.c
index cbc42207496d..791ecf89d71c 100644
--- a/drivers/acpi/acpica/exstore.c
+++ b/drivers/acpi/acpica/exstore.c
@@ -299,6 +299,12 @@ acpi_ex_store_object_to_index(union acpi_operand_object *source_desc,

 			/* Note: Takes advantage of common string/buffer fields */

+			if (source_desc->buffer.pointer == NULL ||
+			    source_desc->buffer.length == 0) {
+				status = AE_BAD_PARAMETER;
+				break;
+			}
+
 			value = source_desc->buffer.pointer[0];
 			break;

-- 
2.43.0