From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71C00C4167B for ; Sat, 24 Dec 2022 01:36:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236828AbiLXBge (ORCPT ); Fri, 23 Dec 2022 20:36:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40404 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236735AbiLXBgD (ORCPT ); Fri, 23 Dec 2022 20:36:03 -0500 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 84E0C389F0; Fri, 23 Dec 2022 17:31:59 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id D5B25CE1CF2; Sat, 24 Dec 2022 01:31:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 49953C433EF; Sat, 24 Dec 2022 01:31:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1671845516; bh=Vlh+YpfPid2+xtBUz3BG0TlOUgC0+2HeWwrN0xk4K9k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uhuXhc3Qk8QPl+0tns7xHkZLNNw5Lp3reghLfgzXjl5Q5lGJA7NCxSKDacUAZCk+M hXPy9C930SD5NOKJTNj+3TaWJPA/1zvTK3owvPyx6+q3VohHgUzLQgtXZZ5pnnsY/s CreMTBdt+aZpA+oQNQlXO69UIoqpokxFfWaCNzBdas5CIFIS18kaJo7OhwidkPAXrx bfNPKnCTjRk85jztm3KmdYtrjhqUw4GffCm+3k2iw+m3l/RK9tdj/9BR0aWFGpLu3N qbqFPwznLvX/oZ1ixmvX4uqVKyaUPka7wsEfZrtnrVa0F7g6aQEye0a8Z/AmhDr3y9 lHNNLm46+0OnQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= , Cezary Rojewski , "Rafael J . Wysocki" , Sasha Levin , robert.moore@intel.com, linux-acpi@vger.kernel.org, devel@acpica.org Subject: [PATCH AUTOSEL 5.15 10/14] ACPICA: Fix operand resolution Date: Fri, 23 Dec 2022 20:31:23 -0500 Message-Id: <20221224013127.393187-10-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221224013127.393187-1-sashal@kernel.org> References: <20221224013127.393187-1-sashal@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-acpi@vger.kernel.org From: Amadeusz Sławiński [ Upstream commit 7dfb216eda99bbfc2a8c3b03d2eec63314f52b3c ] In our tests we get UBSAN warning coming from ACPI parser. This is caused by trying to resolve operands when there is none. [ 0.000000] Linux version 5.15.0-rc3chromeavsrel1.0.184+ (root@...) (gcc (Ubuntu 10.3.0-1ubuntu1~20.04) 10.3.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #1 SMP PREEMPT Sat Oct 16 00:08:27 UTC 2021 ... [ 14.719508] ================================================================================ [ 14.719551] UBSAN: array-index-out-of-bounds in /.../linux/drivers/acpi/acpica/dswexec.c:401:12 [ 14.719594] index -1 is out of range for type 'acpi_operand_object *[9]' [ 14.719621] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc3chromeavsrel1.0.184+ #1 [ 14.719657] Hardware name: Intel Corp. Geminilake/GLK RVP2 LP4SD (07), BIOS GELKRVPA.X64.0214.B50.2009111159 09/11/2020 [ 14.719694] Call Trace: [ 14.719712] dump_stack_lvl+0x38/0x49 [ 14.719749] dump_stack+0x10/0x12 [ 14.719775] ubsan_epilogue+0x9/0x45 [ 14.719801] __ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 14.719835] acpi_ds_exec_end_op+0x1d7/0x6b5 [ 14.719870] acpi_ps_parse_loop+0x942/0xb34 ... Problem happens because WalkState->NumOperands is 0 and it is used when trying to access into operands table. Actual code is: WalkState->Operands [WalkState->NumOperands -1] which causes out of bound access. Improve the check before above access to check if ACPI opcode should have any arguments (operands) at all. Link: https://github.com/acpica/acpica/pull/745 Signed-off-by: Amadeusz Sławiński Reviewed-by: Cezary Rojewski Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin --- drivers/acpi/acpica/dswexec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/acpi/acpica/dswexec.c b/drivers/acpi/acpica/dswexec.c index f2d2267054af..45032da245a7 100644 --- a/drivers/acpi/acpica/dswexec.c +++ b/drivers/acpi/acpica/dswexec.c @@ -389,9 +389,11 @@ acpi_status acpi_ds_exec_end_op(struct acpi_walk_state *walk_state) /* * All opcodes require operand resolution, with the only exceptions - * being the object_type and size_of operators. + * being the object_type and size_of operators as well as opcodes that + * take no arguments. */ - if (!(walk_state->op_info->flags & AML_NO_OPERAND_RESOLVE)) { + if (!(walk_state->op_info->flags & AML_NO_OPERAND_RESOLVE) && + (walk_state->op_info->flags & AML_HAS_ARGS)) { /* Resolve all operands */ -- 2.35.1