[PATCH AUTOSEL 6.18-6.12] spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs

[PATCH AUTOSEL 6.18-6.12] spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs

[Sasha Levin]

From: Thomas Lin <thomas_lin@lecomputing.com>

[ Upstream commit 019947c495850461242fdcc0780258805595036c ]

This ID requires a custom initialization function
dw_spi_hssi_no_dma_init() that sets dws->dws.ip to DW_HSSI_ID.

Signed-off-by: Thomas Lin <thomas_lin@lecomputing.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260521-lecarc-acpi-ids-v1-2-ae0ae90b2817@lecomputing.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

Connection lost, reconnecting to https://agentn.us.api5.cursor.sh
(attempt 1)...
Retry attempt 1...
# Stable Backport Analysis: `spi: dw-mmio: Add ACPI ID LECA0002 for
LECARC SoCs`

**Local tree:** `v6.18.44` (`stable/linux-6.18.y`, detached HEAD at
`1efe5d048a391`)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject line
**Record:** `[spi: dw-mmio]` `[Add]` — Add ACPI ID `LECA0002` for LECARC
SoCs SPI controller enablement on ACPI/ARM64 platforms.

### Step 1.2: Tags
**Record:**
- **Signed-off-by:** Thomas Lin \<thomas_lin@lecomputing.com\> (author)
- **Reviewed-by:** Andy Shevchenko \<andriy.shevchenko@linux.intel.com\>
- **Link:** https://patch.msgid.link/20260521-lecarc-acpi-
  ids-v1-2-ae0ae90b2817@lecomputing.com
- **Signed-off-by:** Mark Brown \<broonie@kernel.org\> (SPI maintainer
  merge tag in final commit)
- **Acked-by:** Mark Brown (in v1 mbox submission)
- No Fixes:, Reported-by:, Tested-by:, Cc: stable@
- Notable: subsystem maintainer ack; no syzbot/user bug reports

### Step 1.3: Body text
**Record:**
- **Bug description:** LECARC SoCs expose SPI via ACPI HID `LECA0002`;
  without this ID the existing `dw_spi_mmio` driver does not bind.
- **Symptom:** SPI controller non-functional on LECARC ACPI boots (no
  driver probe).
- **Root cause:** Missing ACPI ID in `acpi_apd.c` (clock/platform device
  creation) and `spi-dw-mmio.c` (driver match + HSSI init).
- **Init requirement:** Must use `dw_spi_hssi_no_dma_init()` to set
  `dws->ip = DW_HSSI_ID` (HSSI register layout, no DMA).
- **Version info:** None explicit; part of v5 series dated 2026-05-21.

### Step 1.4: Hidden bug fix?
**Record:** No — this is hardware enablement (ACPI ID addition), not a
regression fix. The function rename (`dw_spi_intel_init` →
`dw_spi_hssi_no_dma_init`) is cosmetic; behavior is unchanged. Without
the ACPI entry, hardware simply does not probe; there is no pre-existing
broken path for current 6.18.y users.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory
**Record:**
| File | Changes |
|------|---------|
| `drivers/acpi/acpi_apd.c` | +6 lines (new `leca_spi_desc`, table
entry) |
| `drivers/spi/spi-dw-mmio.c` | +2 lines net (rename + ACPI entry) |
| **Total:** ~15 lines | **Functions:** none structurally changed;
rename only |
| **Scope:** Single-subsystem, surgical ACPI ID addition |

### Step 2.2: Code flow per hunk
**Record:**
1. **`acpi_apd.c` — `leca_spi_desc`:** Adds APD descriptor with
   `fixed_clk_rate = 400000000` so ACPI scan creates a platform device
   with correct clock for `LECA0002`.
2. **`acpi_apd.c` — device ID table:** Maps `"LECA0002"` →
   `leca_spi_desc` under `CONFIG_ARM64`.
3. **`spi-dw-mmio.c` — rename:** `dw_spi_intel_init` →
   `dw_spi_hssi_no_dma_init`; identical body (sets `DW_HSSI_ID`, no DMA
   setup).
4. **`spi-dw-mmio.c` — OF table:** Updates `intel,keembay-ssi` to use
   renamed init (no behavior change).
5. **`spi-dw-mmio.c` — ACPI table:** Adds `{"LECA0002",
   dw_spi_hssi_no_dma_init}` so driver probes and configures HSSI IP
   correctly.

**Before → After:** LECARC SPI ACPI node ignored → platform device
created + `dw_spi_mmio` probes with HSSI register programming.

### Step 2.3: Bug mechanism
**Record:** **Category:** Hardware enablement / ACPI ID addition
(exception category, not crash/leak/race fix). **Mechanism:** Without
ACPI match, `dw_spi_mmio` never probes; with probe but wrong IP type
(`dws->ip` defaults to 0 = PSSI via `devm_kzalloc`),
`dw_spi_update_config()` would use PSSI register field masks instead of
HSSI — incorrect SPI operation. The init function prevents that.

### Step 2.4: Fix quality
**Record:** Obviously correct — follows existing `HISI0173` pattern in
both `acpi_apd.c` and `spi-dw-mmio.c`. Reuses proven `dw_spi_intel_init`
logic. Minimal risk; rename is zero functional change. No API changes.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:** `dw_spi_intel_init` introduced in `dc4e6d9fbf9a3`
(2022-07-13, Intel Keem Bay). ACPI SPI support since `32215a6c6beb8`
(2018-12-03, `HISI0173`). All prerequisite code long present in 6.18.y.

### Step 3.2: Fixes: tag
**Record:** N/A — no Fixes: tag.

### Step 3.3: Related file history
**Record:** Recent changes to `spi-dw-mmio.c` in 6.18.y include reset
error handling (`18a5f1af596e6`), `remove` callback conversion —
unrelated to this hunk. Standalone patch; companion GPIO patch
(`LECA0001`) is separate subsystem.

### Step 3.4: Author history
**Record:** No prior Thomas Lin commits in `drivers/spi/` or
`drivers/acpi/` in this tree. First-time contributor for this platform;
patch reviewed/acked by SPI maintainer.

### Step 3.5: Dependencies
**Record:** No code dependencies on other commits. Part of 2-patch
series (GPIO + SPI) for full LECARC ACPI support, but SPI patch is self-
contained. `DW_HSSI_ID`, `dw_spi_intel_init`, ACPI framework all
present. Applies standalone.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original discussion
**Record:** `b4 am -l '20260521-lecarc-acpi-
ids-v1-2-ae0ae90b2817@lecomputing.com'` — thread found (v5, 2 patches).
Cover: `arm64: Add LECARC ACPI IDs for DesignWare GPIO, SPI`. SPI patch
acked by Mark Brown, reviewed by Andy Shevchenko. No stable nomination
found in cover or patch. No NAKs in retrieved thread.

### Step 4.2: Reviewers
**Record:** Andy Shevchenko (Reviewed-by), Mark Brown (Acked-by/Signed-
off-by), Bartosz Golaszewski reviewed GPIO patch. Appropriate subsystem
coverage.

### Step 4.3: Bug reports
**Record:** None — no user/syzbot reports. Enablement for new LE
Computing LECARC SoC platform.

### Step 4.4: Series context
**Record:** Patch 2/2 of series. Patch 1 adds `LECA0001` to `gpio-
dwapb.c` (not in 6.18.44 tree). Full platform needs both; SPI patch
independently valuable.

### Step 4.5: Stable list
**Record:** Could not search lore stable list (bot protection). No
stable discussion found in retrieved mbox.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key functions
**Record:** `dw_spi_hssi_no_dma_init()` (renamed from
`dw_spi_intel_init`), `acpi_apd_create_device()`, `dw_spi_mmio_probe()`,
`dw_spi_update_config()` (uses `dw_spi_ip_is()`).

### Step 5.2: Callers
**Record:** Init called from `dw_spi_mmio_probe()` via
`device_get_match_data()` when ACPI/OF matches.
`acpi_apd_create_device()` called during ACPI scan at boot. Boot-time
device enumeration path.

### Step 5.3: Callees
**Record:** Init only sets `dwsmmio->dws.ip = DW_HSSI_ID`. Probe
continues to `dw_spi_add_host()`. `dw_spi_update_config()` branches on
`dw_spi_ip_is(dws, PSSI)` vs HSSI paths.

### Step 5.4: Reachability
**Record:** Triggered at boot on LECARC hardware with ACPI +
`CONFIG_ARM64` + SPI enabled. Not userspace-triggered; affects platform
bring-up only.

### Step 5.5: Similar patterns
**Record:** `HISI0173` uses identical dual-registration pattern
(`acpi_apd.c` + `spi-dw-mmio.c`). `intel,keembay-ssi` already uses same
init via OF. LECA0002 mirrors Keem Bay HSSI-no-DMA pattern.

---

## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE (6.18.44)

### Step 6.1: Buggy/missing code exists?
**Record:** **YES — code is missing.** `LECA0002` absent from both
`acpi_apd.c` and `spi-dw-mmio.c`. `dw_spi_intel_init` present (line
231). `LECA0001` also absent from `gpio-dwapb.c`. Infrastructure fully
present since 2018–2022.

### Step 6.2: Backport complications
**Record:** **`git apply --check` PASS** — patch applies cleanly to
6.18.44 without modification. Minor line-number offset only
(`dw_spi_remove_host` vs mainline `dw_spi_remove_controller` not in
hunks).

### Step 6.3: Related fixes already present?
**Record:** None. `git log --grep=LECA0002` and `git log --grep=lecarc`
return no matches in this tree.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: Subsystem criticality
**Record:** `drivers/spi/` + `drivers/acpi/` — **IMPORTANT** (common
infrastructure), but fix affects only LECARC ARM64 ACPI platform users.

### Step 7.2: Activity
**Record:** `spi-dw-mmio` actively maintained; recent stable-relevant
fixes (reset handling). Mature driver with established ACPI ID pattern.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who is affected
**Record:** LECARC SoC users booting 6.18.y with ACPI on ARM64. Very
small, platform-specific population. No impact on existing hardware.

### Step 8.2: Trigger conditions
**Record:** Boot on LECARC with `LECA0002` ACPI node. Deterministic for
that hardware. Not triggerable by unprivileged users on other platforms.

### Step 8.3: Failure mode severity
**Record:** Without patch: SPI does not work (hardware non-functional) —
**MEDIUM** for affected users (platform bring-up blocked), **NONE** for
everyone else. Not a crash/corruption on existing systems.

### Step 8.4: Risk-benefit
**Record:**
- **Benefit:** Enables SPI on LECARC for 6.18.y distributors shipping
  that hardware — aligns with official stable rule allowing device ID
  additions.
- **Risk:** Very low — ~15 lines, table entries only, no logic changes
  beyond rename.
- **Ratio:** High benefit for LECARC users, negligible risk for all
  others.

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence compile

**FOR backport:**
- Official `stable-kernel-rules.rst` line 15: *"must either fix a real
  bug … or **just add a device ID**"*
- ACPI ID addition to existing `dw_spi_mmio` and `acpi_apd` drivers —
  textbook stable exception
- Small (~15 lines), reviewed, maintainer-acked
- Applies cleanly to 6.18.44
- Follows established `HISI0173` pattern
- Correct HSSI init prevents wrong register programming if probed

**AGAINST backport:**
- Not a bug fix for existing 6.18.y users
- Very niche hardware (LECARC)
- Companion GPIO patch (`LECA0001`) also needed for full platform
- Must land in mainline first (procedural stable requirement)
- No user bug reports or crash reports

**Unresolved:** Whether commit is merged to mainline yet (not in
6.18.44); lore stable-list search blocked.

### Step 9.2: Stable rules checklist
1. Obviously correct and tested? **PASS** — maintainer ack, reviewer
   sign-off, mirrors existing IDs
2. Fixes real bug affecting users? **PASS** — via device-ID exception;
   SPI non-functional without it on LECARC
3. Important issue? **PASS (qualified)** — platform hardware enablement
   for affected users; not crash/security
4. Small and contained? **PASS** — ~15 lines, 2 files
5. No new features/APIs? **PASS** — ACPI ID only; no new uapi
6. Can apply to local tree? **PASS** — verified clean apply

### Step 9.3: Exception category
**Record:** **NEW DEVICE ID (ACPI ID)** — explicitly permitted by
stable-kernel-rules.rst and analysis guidelines.

### Step 9.4: Decision rationale

For **Linux 6.18.y**, this commit adds an ACPI HID to two existing,
mature drivers so LECARC SPI hardware can probe and operate correctly.
It does not fix a regression affecting current users, but stable rules
explicitly allow backports that *"just add a device ID."* The change is
minimal, maintainer-reviewed, applies cleanly, and reuses existing init
logic. Distributors shipping LECARC on 6.18.y need this patch.

---

## Verification

- **[Phase 1]** Parsed subject, tags, body from user-provided commit and
  mbox
- **[Phase 2]** Diff analysis: 2 files, ~15 lines; rename verified
  identical to `dw_spi_intel_init`
- **[Phase 3]** `git describe HEAD` → v6.18.44; `git blame` on lines
  231–237 → `dc4e6d9fbf9a3` (2022); ACPI support `32215a6c6beb8` (2018)
- **[Phase 3]** `git log --oneline -15 -- drivers/spi/spi-dw-mmio.c
  drivers/acpi/acpi_apd.c` — no LECA commits
- **[Phase 3]** `git log --grep=LECA0002` / `--grep=lecarc` — no matches
  in tree
- **[Phase 4]** `b4 am -l` on msgid — v5 series, 2 patches, Mark Brown
  Acked-by
- **[Phase 4]** Read cover letter and mbox — platform enablement, no
  stable Cc
- **[Phase 4]** lore.kernel.org WebFetch — blocked by bot protection
- **[Phase 5]** `grep dw_spi_ip_is` — IP type controls register
  programming in `spi-dw-core.c`
- **[Phase 5]** `dw_spi_mmio_probe` — init via `device_get_match_data()`
  at line 376
- **[Phase 6]** `grep LECA0002` — not present in tree
- **[Phase 6]** `grep dw_spi_intel_init` — present at lines 231, 416
- **[Phase 6]** `git apply --check` — **clean apply confirmed**
- **[Phase 6]** `grep LECA0001` in gpio-dwapb — not present (companion
  patch missing)
- **[Phase 7]** Read `Documentation/process/stable-kernel-rules.rst`
  line 15 — device ID exception confirmed
- **[Phase 8]** Impact: platform-specific SPI enablement only

---

**YES**The background git searches finished: there are **no commits** in
this 6.18.44 tree matching `LECA0002`, `lecarc`, or `dw_spi_intel_init`
in commit messages. That confirms the LECARC SPI ACPI support isn’t
present yet and nothing equivalent was already backported.

That lines up with the earlier analysis: the patch applies cleanly here
and is a good stable candidate under the ACPI device-ID exception. The
companion GPIO patch (`LECA0001`) is also still missing from this tree
if full LECARC ACPI bring-up is needed.

 drivers/acpi/acpi_apd.c   | 7 +++++++
 drivers/spi/spi-dw-mmio.c | 7 ++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/acpi/acpi_apd.c b/drivers/acpi/acpi_apd.c
index 49539f7528c64..cd0fcfaeafc75 100644
--- a/drivers/acpi/acpi_apd.c
+++ b/drivers/acpi/acpi_apd.c
@@ -181,6 +181,12 @@ static const struct apd_device_desc hip08_spi_desc = {
 	.setup = acpi_apd_setup,
 	.fixed_clk_rate = 250000000,
 };
+
+static const struct apd_device_desc leca_spi_desc = {
+	.setup = acpi_apd_setup,
+	.fixed_clk_rate = 400000000,
+};
+
 #endif /* CONFIG_ARM64 */
 
 #endif
@@ -251,6 +257,7 @@ static const struct acpi_device_id acpi_apd_device_ids[] = {
 	{ "HISI02A2", APD_ADDR(hip08_i2c_desc) },
 	{ "HISI02A3", APD_ADDR(hip08_lite_i2c_desc) },
 	{ "HISI0173", APD_ADDR(hip08_spi_desc) },
+	{ "LECA0002", APD_ADDR(leca_spi_desc) },
 	{ "NXP0001", APD_ADDR(nxp_i2c_desc) },
 #endif
 	{ }
diff --git a/drivers/spi/spi-dw-mmio.c b/drivers/spi/spi-dw-mmio.c
index 7a5197586919c..8f7afe0e49aea 100644
--- a/drivers/spi/spi-dw-mmio.c
+++ b/drivers/spi/spi-dw-mmio.c
@@ -228,8 +228,8 @@ static int dw_spi_hssi_init(struct platform_device *pdev,
 	return 0;
 }
 
-static int dw_spi_intel_init(struct platform_device *pdev,
-			     struct dw_spi_mmio *dwsmmio)
+static int dw_spi_hssi_no_dma_init(struct platform_device *pdev,
+				   struct dw_spi_mmio *dwsmmio)
 {
 	dwsmmio->dws.ip = DW_HSSI_ID;
 
@@ -413,7 +413,7 @@ static const struct of_device_id dw_spi_mmio_of_match[] = {
 	{ .compatible = "amazon,alpine-dw-apb-ssi", .data = dw_spi_alpine_init},
 	{ .compatible = "renesas,rzn1-spi", .data = dw_spi_pssi_init},
 	{ .compatible = "snps,dwc-ssi-1.01a", .data = dw_spi_hssi_init},
-	{ .compatible = "intel,keembay-ssi", .data = dw_spi_intel_init},
+	{ .compatible = "intel,keembay-ssi", .data = dw_spi_hssi_no_dma_init},
 	{
 		.compatible = "intel,mountevans-imc-ssi",
 		.data = dw_spi_mountevans_imc_init,
@@ -428,6 +428,7 @@ MODULE_DEVICE_TABLE(of, dw_spi_mmio_of_match);
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id dw_spi_mmio_acpi_match[] = {
 	{"HISI0173", (kernel_ulong_t)dw_spi_pssi_init},
+	{"LECA0002", (kernel_ulong_t)dw_spi_hssi_no_dma_init},
 	{},
 };
 MODULE_DEVICE_TABLE(acpi, dw_spi_mmio_acpi_match);
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: Prevent adding invalid references

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit 6e8c55e13a5e3a9f38921d62924f18ceba3330eb ]

Prevent adding references for local, argument, and debug objects
in acpi_ut_copy_simple_object().

Link: https://github.com/acpica/acpica/commit/f576898d7814
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/4511989.ejJDZkT8p0@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: ACPICA: Prevent adding invalid references

## Tree Context

Local checkout: **v6.18.44** (6.18.44). The fix is **not** present in
this tree; the buggy code remains at `drivers/acpi/acpica/utcopy.c:734`.

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject Line
**Record:** `[ACPICA] [prevent] — Prevent adding invalid references in
acpi_ut_copy_simple_object() when copying LOCAL/ARG/DEBUG reference
objects.`

### Step 1.2: Tags
**Record:**
- **Link:** https://github.com/acpica/acpica/commit/f576898d7814
  (upstream ACPICA commit)
- **Link:** https://patch.msgid.link/4511989.ejJDZkT8p0@rafael.j.wysocki
  (kernel submission; fetch blocked by bot protection)
- **Signed-off-by:** ikaros <void0red@gmail.com> (author)
- **Signed-off-by:** Rafael J. Wysocki <rafael.j.wysocki@intel.com>
  (ACPI maintainer)
- No Fixes:, Reported-by:, Tested-by:, Reviewed-by:, Cc: stable@
- Notable: Submitted as **[PATCH v1 15/27] ACPI: ACPICA 20260408**
  series (May 27, 2026)

### Step 1.3: Body Analysis
**Record:**
- **Bug:** `acpi_ut_copy_simple_object()` unconditionally calls
  `acpi_ut_add_reference(source_desc->reference.object)` for all
  reference classes except `ACPI_REFCLASS_TABLE`.
- **Problem:** LOCAL, ARG, and DEBUG references do not have a valid
  operand-object pointer in `reference.object`.
- **Symptom:** Use-after-free when `acpi_ut_add_reference()` →
  `acpi_ut_valid_internal_object()` reads freed memory (confirmed in
  ACPICA issue #1127 with ASAN stack trace).
- **Root cause:** LOCAL/ARG use `reference.value` (and may store a
  namespace-node pointer in `object` via cast); DEBUG sets only
  `reference.class` with no valid `object`. Calling
  `acpi_ut_add_reference()` on these is semantically wrong and can
  dereference stale/freed pointers.

### Step 1.4: Hidden Bug Fix Detection
**Record:** Yes — despite the neutral "prevent" wording, this is a real
memory-safety bug fix (UAF), not cleanup. It extends the existing 2008
`ACPI_REFCLASS_TABLE` exemption pattern to the three other reference
classes that similarly lack a valid operand-object pointer.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory
**Record:**
- **Files:** `drivers/acpi/acpica/utcopy.c` (+9, -1)
- **Function:** `acpi_ut_copy_simple_object()`
- **Scope:** Single-file, surgical fix in one `case
  ACPI_TYPE_LOCAL_REFERENCE:` block

### Step 2.2: Code Flow Change
**Record:**
- **Before:** After exempting `ACPI_REFCLASS_TABLE`, always call
  `acpi_ut_add_reference(source_desc->reference.object)`.
- **After:** Also skip `acpi_ut_add_reference()` for
  `ACPI_REFCLASS_LOCAL`, `ACPI_REFCLASS_ARG`, and `ACPI_REFCLASS_DEBUG`.
- **Path affected:** Object-copy path used when duplicating ACPI
  internal objects (packages, CopyObject opcode, store operations).

### Step 2.3: Bug Mechanism
**Record:**
- **Category:** Use-after-free / invalid pointer dereference
- **Mechanism:** For LOCAL/ARG/DEBUG references, `reference.object` is
  not a valid `union acpi_operand_object *`. `acpi_ut_add_reference()`
  calls `acpi_ut_valid_internal_object()` which reads
  `ACPI_GET_DESCRIPTOR_TYPE(object)` from that pointer — triggering UAF
  when the pointer is stale (e.g., freed walk-state memory per ACPICA
  issue #1127 ASAN report).

### Step 2.4: Fix Quality
**Record:**
- Obviously correct: mirrors the existing TABLE exemption and matches
  how `exresolv.c` treats these classes ("do not dereference").
- Minimal, no unrelated changes.
- Low regression risk: only skips refcount increment that should never
  have happened for these three classes.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:**
- Reference-handling case dates to **2005** (initial ACPICA import).
- `acpi_ut_add_reference()` call: **2005** (Len Brown).
- `ACPI_REFCLASS_TABLE` exemption: **2008** (Bob Moore, commit
  `1044f1f65b7df2`) — LOCAL/ARG/DEBUG were never added.
- Bug has been present since ~2005; TABLE partial fix since 2008.

### Step 3.2: Fixes: Tag
**Record:** N/A — no Fixes: tag. Upstream ACPICA issue #1127 references
commit f576898.

### Step 3.3: Related File History
**Record:**
- `470188b09e92d` (2022): Fixed a separate UAF in
  `acpi_ut_copy_ipackage_to_ipackage()` in the same file — shows this
  code path is security-relevant and prior UAF fixes were backported.
- `b6a163875935c` (2008): Warn on invalid package references — related
  defensive work in ACPI reference handling.
- This fix is **standalone** (patch 15/27 of ACPICA bulk update, but
  functionally independent).

### Step 3.4: Author Context
**Record:** ikaros reported the bug to ACPICA upstream. Rafael J.
Wysocki (ACPI maintainer) signed off and submitted to linux-acpi. Author
has prior kernel commits (null-check fixes).

### Step 3.5: Dependencies
**Record:** No dependencies. Self-contained 8-line conditional. All
referenced symbols (`ACPI_REFCLASS_LOCAL/ARG/DEBUG`) exist in this
tree's `acobject.h`.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original Discussion
**Record:**
- `b4 dig -c f576898d7814`: Failed (ACPICA upstream SHA, not in Linux
  git).
- Web search found submission: **[PATCH v1 15/27] ACPICA: Prevent adding
  invalid references** at lkml.iu.edu (May 27, 2026), part of ACPI:
  ACPICA 20260408 series by Rafael J. Wysocki.
- ACPICA GitHub issue #1127: ASAN heap-use-after-free in
  `AcpiUtValidInternalObject` via `AcpiUtAddReference` →
  `AcpiUtCopySimpleObject`, reproduced with `acpiexec -m issue11.aml`.

### Step 4.2: Reviewers
**Record:** Rafael J. Wysocki submitted and signed off — ACPI subsystem
maintainer endorsement. Full recipient list unavailable (b4 dig failed;
lore blocked).

### Step 4.3: Bug Report
**Record:**
- ACPICA issue #1127: **heap-use-after-free**, READ of size 1 in
  `acpi_ut_valid_internal_object`.
- Call chain: `acpi_ut_copy_simple_object` → `acpi_ut_add_reference` →
  `acpi_ut_valid_internal_object`.
- Triggered during AML parsing/execution (`acpi_ps_parse_aml`, table
  load).
- Severity: memory safety, potential crash/corruption.

### Step 4.4: Series Context
**Record:** Part of 27-patch ACPICA 20260408 update. This patch is
standalone; does not require other series patches.

### Step 4.5: Stable List History
**Record:** UNVERIFIED — could not search lore.kernel.org/stable (bot
protection). No evidence against stable nomination.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key Functions
**Record:** `acpi_ut_copy_simple_object()` (modified); callers:
`acpi_ut_copy_ielement_to_ielement()`,
`acpi_ut_copy_iobject_to_iobject()`.

### Step 5.2: Callers
**Record:**
- `acpi_ut_copy_iobject_to_iobject()` called from:
  - `exoparg1.c` — `AML_COPY_OBJECT_OP`
  - `exstore.c`, `exstoren.c` — store operations
  - `dsutils.c`, `dsmthdat.c` — dispatcher/method data
- All are core ACPI AML execution paths, active during boot and runtime
  ACPI method evaluation.

### Step 5.3: Callees
**Record:** `acpi_ut_add_reference()` →
`acpi_ut_valid_internal_object()` → reads descriptor type from pointer.
For invalid `reference.object`, this is the UAF site.

### Step 5.4: Reachability
**Record:**
- Triggered when copying packages or objects containing LOCAL/ARG/DEBUG
  references.
- ASAN reproducer uses AML table execution during namespace load.
- Reachable on every ACPI-enabled system during DSDT/SSDT evaluation and
  method execution. Not limited to obscure configs.

### Step 5.5: Similar Patterns
**Record:**
- `utcopy.c:730`: `ACPI_REFCLASS_TABLE` already exempted (same
  rationale).
- `exresolv.c:208-212`: DEBUG/TABLE/REFOF — "Just leave the object as-
  is, do not dereference."
- `dsobject.c:471-522`: LOCAL/ARG set `reference.value`; DEBUG sets only
  `reference.class` — confirms `object` is not a refcountable operand
  object.

---

## PHASE 6: CROSS-REFERENCE WITH LOCAL TREE (v6.18.44)

### Step 6.1: Buggy Code Present?
**Record:** **YES.** At `drivers/acpi/acpica/utcopy.c:721-735`,
unconditional `acpi_ut_add_reference(source_desc->reference.object)`
after only TABLE exemption. Fix text not found via grep.

### Step 6.2: Backport Complications
**Record:** **Clean apply expected.** Index context matches submitted
patch (line ~731). No conflicting recent changes to this hunk. Only
copyright-year churn in file history.

### Step 6.3: Related Fixes Already Present?
**Record:** `470188b09e92d` (UAF in `acpi_ut_copy_ipackage_to_ipackage`)
is present. No duplicate fix for LOCAL/ARG/DEBUG reference handling.

---

## PHASE 7: SUBSYSTEM CONTEXT

### Step 7.1: Subsystem
**Record:** **ACPI/ACPICA** — **CORE** subsystem. Affects all x86
systems and ARM64 systems using ACPI.

### Step 7.2: Activity
**Record:** Actively maintained; recent ACPICA fixes in this tree
include UAF, NULL deref, and AML safety patches.

---

## PHASE 8: IMPACT AND RISK

### Step 8.1: Who Is Affected
**Record:** All users with ACPI enabled (essentially all PCs, servers,
many ARM laptops). Driver-specific? No — core ACPI interpreter.

### Step 8.2: Trigger Conditions
**Record:** Copying ACPI internal objects (packages, CopyObject) that
contain LOCAL, ARG, or DEBUG reference elements. Can be triggered by
ACPI AML in firmware tables. Timing-dependent UAF when
`reference.object` holds stale pointer. Unprivileged users cannot
directly trigger, but firmware/ACPI tables are the attack surface.

### Step 8.3: Failure Mode
**Record:** **Heap use-after-free** in `acpi_ut_valid_internal_object`.
Severity: **HIGH** (crash, potential memory corruption). Could manifest
as oops during boot, suspend/resume, or device hotplug ACPI methods.

### Step 8.4: Risk-Benefit
**Record:**
- **Benefit:** HIGH — prevents UAF in core ACPI object-copy path on all
  ACPI systems.
- **Risk:** VERY LOW — 8-line conditional extending an established
  pattern; no API/behavior change for valid reference types (REFOF,
  INDEX, NAME still get refcounted).
- **Ratio:** Strongly favors backport.

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence Summary

**FOR backport:**
- Confirmed UAF (ASAN report in ACPICA #1127)
- Long-standing bug (since 2005; TABLE partial fix since 2008)
- Buggy code present in v6.18.44
- Core ACPI path (boot, AML execution)
- Small, surgical, obviously correct fix
- Matches existing TABLE exemption and exresolv.c semantics
- ACPI maintainer (Rafael Wysocki) signed off and submitted
- Prior UAF fix in same file was backported to stable

**AGAINST backport:**
- No kernel runtime reproducer in commit message (only acpiexec/AML test
  case)
- Part of larger ACPICA bulk update (but this patch is standalone)
- Not yet merged into this 6.18.44 tree (candidate evaluation)

**Unresolved:**
- Lore stable-list discussion (site blocked)
- Exact frequency in production firmware (unverified, but bug mechanism
  is clear)

### Step 9.2: Stable Rules Checklist
1. Obviously correct and tested? **PASS** — logic mirrors TABLE
   exemption; ASAN-verified upstream; maintainer SOB.
2. Fixes a real bug? **PASS** — UAF in object copy.
3. Important issue? **PASS** — UAF/memory corruption in core ACPI,
   severity HIGH.
4. Small and contained? **PASS** — 9 lines, one file, one function.
5. No new features/APIs? **PASS** — defensive guard only.
6. Can apply to local tree? **PASS** — buggy code present, clean apply
   expected.

### Step 9.3: Exception Categories
**Record:** N/A (not device ID, quirk, DT, build, or docs — standard bug
fix).

### Step 9.4: Decision Rationale
This commit fixes a verified use-after-free in the ACPICA object-copy
path that has existed since the code was written. LOCAL, ARG, and DEBUG
references never had valid operand-object pointers in `reference.object`
— the 2008 TABLE exemption proves the developers knew some reference
classes must skip `acpi_ut_add_reference()`. The fix is minimal, follows
established patterns in the same file and in `exresolv.c`, and protects
all ACPI-enabled systems during AML execution. For v6.18.44, the buggy
code is present and the fix applies cleanly.

---

## Verification

- [Phase 1] Parsed subject, tags, body; identified UAF bug from ACPICA
  issue #1127
- [Phase 1] Web search: found [PATCH v1 15/27] on lkml (May 27, 2026),
  Rafael Wysocki submission
- [Phase 2] Read diff: +9/-1 in `acpi_ut_copy_simple_object()`,
  LOCAL/ARG/DEBUG guard added
- [Phase 2] Read `acobject.h:340-365`: LOCAL/ARG use `value`, DEBUG has
  no valid `object`
- [Phase 2] Read `dsobject.c:462-522`: LOCAL/ARG/DEBUG creation confirms
  no operand-object in `reference.object`
- [Phase 2] Read `utdelete.c:677-696`: `acpi_ut_add_reference()` calls
  `acpi_ut_valid_internal_object()`
- [Phase 2] Read `utobject.c:305-335`: `acpi_ut_valid_internal_object()`
  reads descriptor type (UAF site)
- [Phase 3] `git blame -L 721,735`: buggy code from 2005; TABLE
  exemption from 2008 (`1044f1f65b7df2`)
- [Phase 3] `git log -20 -- utcopy.c`: related UAF fix `470188b09e92d`
  present in tree
- [Phase 3] `git show 1044f1f65b7df2`: TABLE exemption rationale
  documented
- [Phase 3] `git show 470188b09e92d`: prior UAF in same file, backported
  class of bug
- [Phase 4] `b4 dig -c f576898d7814`: failed (ACPICA SHA not in Linux
  git) — used web search instead
- [Phase 4] ACPICA GitHub issue #1127: ASAN UAF stack trace, acpiexec
  reproducer
- [Phase 4] ACPICA GitHub commit f576898: confirms fix details
- [Phase 4] UNVERIFIED: lore.kernel.org and patch.msgid.link blocked by
  bot protection
- [Phase 5] `grep acpi_ut_copy_simple_object`: callers in utcopy.c,
  exoparg1.c, exstore.c, dsutils.c, dsmthdat.c
- [Phase 5] Read `exresolv.c:208-212`: DEBUG/TABLE/REFOF not
  dereferenced — consistent with fix
- [Phase 5] Read `exoparg1.c:465-469`: CopyObject opcode uses
  `acpi_ut_copy_iobject_to_iobject`
- [Phase 6] `git describe HEAD`: v6.18.44
- [Phase 6] Read `utcopy.c:721-735`: buggy unconditional
  `acpi_ut_add_reference` confirmed
- [Phase 6] `grep "Local/Arg/Debug references"`: fix NOT in tree
- [Phase 8] ACPICA #1127 ASAN: heap-use-after-free, severity HIGH

**YES**The background `git log --grep` check finished: it found **no
commit** matching “Prevent adding invalid” or “invalid references” in
this tree. That matches what we already saw in `utcopy.c` — the
LOCAL/ARG/DEBUG guard is still missing, so the backport analysis stands
as **YES** for v6.18.44.

 drivers/acpi/acpica/utcopy.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c
index 80458e70ac2bf..9ecf5c3f49ba6 100644
--- a/drivers/acpi/acpica/utcopy.c
+++ b/drivers/acpi/acpica/utcopy.c
@@ -731,7 +731,15 @@ acpi_ut_copy_simple_object(union acpi_operand_object *source_desc,
 			break;
 		}
 
-		acpi_ut_add_reference(source_desc->reference.object);
+		/*
+		 * Local/Arg/Debug references do not have a valid Object pointer
+		 * that can be referenced
+		 */
+		if ((source_desc->reference.class != ACPI_REFCLASS_LOCAL) &&
+		    (source_desc->reference.class != ACPI_REFCLASS_ARG) &&
+		    (source_desc->reference.class != ACPI_REFCLASS_DEBUG)) {
+			acpi_ut_add_reference(source_desc->reference.object);
+		}
 		break;
 
 	case ACPI_TYPE_REGION:
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit 27d27e75ecb752a0b4da848c440bb3a88396ecba ]

Improve argument parsing in acpi_ps_get_next_simple_arg() to handle
remaining AML data safely.

Link: https://github.com/acpica/acpica/commit/ecbb8bcfe301
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2008043.taCxCBeP46@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

## Phase 1: Commit Message Forensics

**Step 1.1 — Subject line**

Record: **[ACPICA] [Improve] argument parsing in
`acpi_ps_get_next_simple_arg()` to handle remaining AML data safely**

**Step 1.2 — Tags**

Record:
- **Link:** https://github.com/acpica/acpica/commit/ecbb8bcfe301
- **Link:** https://patch.msgid.link/2008043.taCxCBeP46@rafael.j.wysocki
  (blocked by bot protection; lkml.iu.edu mirror used instead)
- **Signed-off-by:** ikaros \<void0red@gmail.com\> (author)
- **Signed-off-by:** Rafael J. Wysocki \<rafael.j.wysocki@intel.com\>
  (ACPI maintainer)
- No **Fixes:**, **Reported-by:**, **Cc: stable**, **Tested-by:**, or
  **Reviewed-by:** tags in the message
- Notable: patch is **[PATCH v1 17/27]** in Rafael’s ACPICA sync series
  (May 2026); upstream ACPICA commit fixes GitHub issues **#1073** and
  **#1131**

**Step 1.3 — Body analysis**

Record:
- **Bug:** `acpi_ps_get_next_simple_arg()` reads integer and string AML
  arguments without checking how many bytes remain before
  `parser_state->aml_end`.
- **Symptoms:** Out-of-bounds reads when AML is truncated or a string
  lacks a null terminator within the buffer; downstream code (e.g.
  `strlen()` on the string pointer) can also OOB-read.
- **Root cause:** Unbounded `*aml` / `ACPI_MOVE_*` reads and unbounded
  `while (aml[length])` loop.
- **Fix approach:** Compute `remaining = aml_end - aml`, bounds-check
  all reads, bound the string scan, warn and force a null terminator at
  the buffer edge when needed.

**Step 1.4 — Hidden bug fix?**

Record: **Yes.** “Improve argument parsing” is defensive hardening
against real memory-safety bugs (heap-buffer-overflow confirmed in
upstream ACPICA via ASAN).

---

## Phase 2: Diff Analysis

**Step 2.1 — Inventory**

Record:
- **File:** `drivers/acpi/acpica/psargs.c` (+68 / −10 per lkml; net ~58
  lines)
- **Function:** `acpi_ps_get_next_simple_arg()` only
- **Scope:** Single-file, single-function surgical fix

**Step 2.2 — Code flow per hunk**

Record:
- **ARGP_BYTEDATA:** Before: always read 1 byte. After: read only if
  `remaining >= 1`, else return 0 with `length = 0`.
- **ARGP_WORD/DWORD/QWORDDATA:** Before: always read 2/4/8 bytes. After:
  full read if enough bytes; else zero-init and `memcpy()` partial bytes
  if any remain.
- **ARGP_CHARLIST:** Before: unbounded scan for `'\0'`. After: scan only
  within `remaining`; if no terminator, `ACPI_WARNING`, write `'\0'` at
  `aml[remaining-1]`, set `length = remaining`.
- **Normal path:** `parser_state->aml += length` unchanged.

**Step 2.3 — Bug mechanism**

Record: **Memory safety / buffer overflow (OOB read).** Integer cases
read past `aml_end`; string case can scan past `aml_end` and pass a non-
terminated pointer to later `strlen()`-based code (upstream issue
#1131).

**Step 2.4 — Fix quality**

Record: Fix is minimal, uses existing `aml_end` and `ACPI_PTR_DIFF`
(already used elsewhere in ACPICA). Low regression risk on valid AML.
Minor concern: in-place mutation of AML bytes for malformed strings
(`aml[remaining-1] = 0`), but this only triggers on invalid AML and is
the upstream-chosen mitigation to prevent downstream OOB.

---

## Phase 3: Git History Investigation

**Step 3.1 — Blame**

Record: Buggy logic dates to original ACPICA import (~2005, Bob Moore /
Len Brown). Present in this tree at lines 364–443 of `psargs.c`. Not a
recently introduced regression.

**Step 3.2 — Fixes: tag**

Record: N/A — no `Fixes:` tag in commit message.

**Step 3.3 — Related file history**

Record: Recent `psargs.c` changes in v6.18.44 are copyright updates and
separate memory-leak fixes (`acpi_ps_get_next_field`,
`acpi_ps_get_next_namepath`). No prior fix for this bounds-check issue.

**Step 3.4 — Author commits**

Record: Author ikaros/void0red is an ACPICA contributor (fuzzing-driven
fixes). Rafael Wysocki is ACPI subsystem maintainer; patch submitted as
part of ACPICA v1 27-patch series.

**Step 3.5 — Dependencies**

Record: Listed as patch 17/27 in an ACPICA bulk sync, but the diff is
self-contained — uses only existing `struct acpi_parse_state` fields
(`aml`, `aml_end`, `aml_start`) and `ACPI_PTR_DIFF`. No structural
prerequisites from other series patches identified. **Can apply
standalone.**

---

## Phase 4: Mailing List and External Research

**Step 4.1 — Original discussion**

Record:
- **b4 dig -c ecbb8bcfe301:** Failed (ACPICA SHA not in Linux git)
- **lkml mirror:** https://lkml.iu.edu/2605.3/06252.html — Rafael’s
  [PATCH v1 17/27], May 27 2026
- **Series revisions:** Part of v1 27-patch ACPICA update; no evidence
  of a newer conflicting version for this hunk
- **Stable nomination in thread:** Not found in available sources
- **NAKs:** None found

**Step 4.2 — Reviewers**

Record: Rafael J. Wysocki (maintainer) signed off and submitted. Full
recipient list unavailable (b4/lore blocked).

**Step 4.3 — Bug reports**

Record:
- **GitHub acpica#1073:** ASAN heap-buffer-overflow in
  `AcpiPsGetNextSimpleArg` at integer read (iasl fuzzing)
- **GitHub acpica#1131:** ASAN heap-buffer-overflow via `strlen()` on
  malformed AML string without null terminator (acpiexec); fixed by this
  commit
- Both closed after ecbb8bc

**Step 4.4 — Series context**

Record: One patch in a 27-patch ACPICA sync; this hunk is independent
and does not require the other 26 patches.

**Step 4.5 — Stable list**

Record: Could not search lore stable list (bot protection). No stable-
specific discussion found via web search.

---

## Phase 5: Code Semantic Analysis

**Step 5.1 — Key functions**

Record: `acpi_ps_get_next_simple_arg()` modified.

**Step 5.2 — Callers**

Record:
- `acpi_ps_get_arguments()` in `psloop.c` (constant/string opcode
  arguments during parse loop)
- `acpi_ps_get_next_arg()` in `psargs.c` (general argument fetching)

Both are on the ACPI AML parse path used during table load and method
execution.

**Step 5.3 — Callees**

Record: `acpi_ps_init_op()`, `acpi_ps_get_next_namestring()` (unchanged
paths), `ACPI_MOVE_*` macros, `memcpy()`, `ACPI_WARNING()`.

**Step 5.4 — Reachability**

Record:
- Boot: `acpi_ns_one_complete_parse()` →
  `acpi_ds_init_aml_walk(aml_start, aml_length)` → `acpi_ps_parse_aml()`
  → parse loop → `acpi_ps_get_next_simple_arg()`
- Runtime: ACPI method evaluation uses the same walk/parse path via
  `acpi_ds_init_aml_walk()`
- **Reachable on every ACPI-enabled system** when parsing tables or
  evaluating methods. Trigger requires malformed/truncated AML (buggy
  firmware, corrupted tables, or injected SSDT).

**Step 5.5 — Similar patterns**

Record: No existing bounds-check pattern for this function in v6.18.44.
`parser_state->aml_end` is set in `acpi_ds_init_aml_walk()`
(`dswstate.c:578-586`) for all AML walks. `psloop.c` already uses
`parser_state->aml < parser_state->aml_end` at the loop level, but
individual argument parsing lacked per-field bounds checks.

---

## Phase 6: Cross-Reference Against Local Tree (v6.18.44)

**Step 6.1 — Buggy code present?**

Record: **Yes.** Local tree is `v6.18.44` (Makefile 6.18.44).
`acpi_ps_get_next_simple_arg()` at `psargs.c:364-443` has the unbounded
reads. Commit ecbb8bc is **not** in this tree.

**Step 6.2 — Backport complications**

Record: **Clean apply expected.** lkml diff index (`3526ea109414`)
matches current file structure; only line-offset difference. `aml_end`
field exists in `aclocal.h:912`. `ACPI_PTR_DIFF` used elsewhere in
ACPICA.

**Step 6.3 — Related fixes already present?**

Record: **No.** `git log --grep` found no prior fix for this function’s
bounds checking in `psargs.c`.

---

## Phase 7: Subsystem Context

**Step 7.1 — Subsystem / criticality**

Record: **ACPI / ACPICA parser** — **CORE** for all `CONFIG_ACPI`
systems (essentially all x86 PCs and many ARM servers).

**Step 7.2 — Activity**

Record: ACPICA receives regular maintenance; this is a targeted safety
fix within a periodic upstream sync.

---

## Phase 8: Impact and Risk Assessment

**Step 8.1 — Who is affected**

Record: All ACPI-enabled systems parsing AML at boot or during method
evaluation. Driver-specific only in the sense that it requires ACPI,
which is near-universal on supported platforms.

**Step 8.2 — Trigger conditions**

Record: Malformed or truncated AML bytecode (truncated integer args,
string without `'\0'` within buffer). Uncommon in practice from
legitimate firmware, but confirmed reproducible with fuzzed AML. ACPI
table override/SSDT loading requires elevated privileges; primary
production risk is buggy OEM firmware.

**Step 8.3 — Failure mode severity**

Record: **OOB read** → potential kernel oops, info leak, or further
cascading OOB in `strlen()`. **Severity: HIGH** (boot-time or runtime
crash on ACPI parse path).

**Step 8.4 — Risk vs benefit**

Record:
- **Benefit: HIGH** — prevents memory-safety bug on a core boot path
- **Risk: LOW** — single function, defensive checks, no API change;
  valid AML behavior unchanged
- **Ratio:** Strong benefit, low risk → backport warranted

---

## Phase 9: Final Synthesis

**Evidence FOR backport:**
- Confirmed heap-buffer-overflow (ASAN) in upstream ACPICA for this
  exact function
- Same vulnerable code present in v6.18.44 since ~2005
- `aml_end` infrastructure already exists and is set on all parse paths
- Small, self-contained, maintainer-signed fix
- Prevents OOB reads during ACPI table parsing and method evaluation
- Fits stable criteria: real bug, important (crash/security-class memory
  safety), no new APIs

**Evidence AGAINST backport:**
- Part of a 27-patch ACPICA series (cosmetic concern only; patch is
  standalone)
- In-place AML mutation for malformed strings (edge case; upstream-
  accepted)
- Bugs found via iasl/acpiexec fuzzing, not a field user report (but
  kernel shares the code)

**Stable rules checklist:**
1. Obviously correct and tested? **PASS** — straightforward bounds
   checks; ASAN-verified upstream
2. Fixes a real bug affecting users? **PASS** — OOB read on ACPI parse
   path
3. Important issue? **PASS** — HIGH severity (memory safety / potential
   crash)
4. Small and contained? **PASS** — one function, ~58 net lines
5. No new features or APIs? **PASS** — defensive parsing only
6. Can apply to local tree? **PASS** — buggy code present, dependencies
   satisfied

**Exception category:** N/A (not device ID, quirk, DT, build, or docs)

**Conclusion:** This commit fixes a long-standing memory-safety hole in
core ACPI AML parsing that is present in the v6.18.44 tree. The fix is
surgical, uses existing parser state, and prevents out-of-bounds reads
that can crash the kernel when malformed AML is encountered.

---

## Verification

- [Phase 1] Parsed subject, tags, body from user-provided commit message
  and lkml mirror
- [Phase 1] Confirmed upstream fixes acpica#1073 and #1131 via GitHub
  issue pages
- [Phase 2] Diff analysis: single-function bounds-check fix in
  `acpi_ps_get_next_simple_arg()`
- [Phase 3] `git describe HEAD`: v6.18.44
- [Phase 3] `git blame -L 364,443 drivers/acpi/acpica/psargs.c`: code
  from ~2005
- [Phase 3] `git log --oneline -20 -- drivers/acpi/acpica/psargs.c`: no
  prior bounds-check fix
- [Phase 3] `git log -1 ecbb8bcfe301`: commit not in local tree
- [Phase 4] `b4 dig -c ecbb8bcfe301`: no match (ACPICA-only SHA)
- [Phase 4] lkml.iu.edu/2605.3/06252.html: found [PATCH v1 17/27] with
  identical diff
- [Phase 4] GitHub acpica#1073: ASAN heap-buffer-overflow at integer
  read
- [Phase 4] GitHub acpica#1131: ASAN heap-buffer-overflow via strlen on
  malformed string
- [Phase 5] `grep acpi_ps_get_next_simple_arg`: callers in
  `psloop.c:71`, `psargs.c:769`
- [Phase 5] Read `nsparse.c:173-198`: table parse sets
  `aml_start`/`aml_length` via `acpi_ds_init_aml_walk()`
- [Phase 5] Read `dswstate.c:578-586`: `aml_end` set from `aml_start +
  aml_length`
- [Phase 6] Read `psargs.c:364-443`: confirmed vulnerable code in
  v6.18.44
- [Phase 6] Read `aclocal.h:909-920`: `aml_end` field exists in `struct
  acpi_parse_state`
- [Phase 8] Assessed severity as HIGH based on verified OOB read
  mechanism
- [UNVERIFIED] Full lore.kernel.org review thread (Anubis bot blocked
  direct fetch)
- [UNVERIFIED] Whether any reviewer explicitly nominated for stable (not
  needed for decision)

**YES**The background history searches finished and matched what the
main analysis already used.

**Task 264644** (`git log` on `psargs.c`): Recent changes are copyright
updates and separate leak fixes in `acpi_ps_get_next_field()` /
`acpi_ps_get_next_namepath()`. Nothing related to bounds checking in
`acpi_ps_get_next_simple_arg()`.

**Task 264645** (author/search): No Linux-kernel commits from
ikaros/void0red on this fix; the patch came through Rafael Wysocki’s
ACPICA sync. Recent ACPI work in this tree includes other parser/safety
fixes, but not this one.

That confirms the vulnerable code is still present in **v6.18.44** and
this fix isn’t already here. Verdict remains **YES** for stable
backport.

 drivers/acpi/acpica/psargs.c | 78 +++++++++++++++++++++++++++++++-----
 1 file changed, 68 insertions(+), 10 deletions(-)

diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 3526ea1094146..064652d11d9aa 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -384,6 +384,8 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
 	u32 length;
 	u16 opcode;
 	u8 *aml = parser_state->aml;
+	u32 remaining = (u32)ACPI_PTR_DIFF(parser_state->aml_end, aml);
+	u64 partial_value;
 
 	ACPI_FUNCTION_TRACE_U32(ps_get_next_simple_arg, arg_type);
 
@@ -393,8 +395,13 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
 		/* Get 1 byte from the AML stream */
 
 		opcode = AML_BYTE_OP;
-		arg->common.value.integer = (u64) *aml;
-		length = 1;
+		if (remaining >= 1) {
+			arg->common.value.integer = (u64)*aml;
+			length = 1;
+		} else {
+			arg->common.value.integer = 0;
+			length = 0;
+		}
 		break;
 
 	case ARGP_WORDDATA:
@@ -402,8 +409,19 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
 		/* Get 2 bytes from the AML stream */
 
 		opcode = AML_WORD_OP;
-		ACPI_MOVE_16_TO_64(&arg->common.value.integer, aml);
-		length = 2;
+		if (remaining >= 2) {
+			ACPI_MOVE_16_TO_64(&arg->common.value.integer, aml);
+			length = 2;
+		} else {
+			arg->common.value.integer = 0;
+			length = 0;
+			if (remaining > 0) {
+				partial_value = 0;
+				memcpy(&partial_value, aml, remaining);
+				arg->common.value.integer = partial_value;
+				length = remaining;
+			}
+		}
 		break;
 
 	case ARGP_DWORDDATA:
@@ -411,8 +429,19 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
 		/* Get 4 bytes from the AML stream */
 
 		opcode = AML_DWORD_OP;
-		ACPI_MOVE_32_TO_64(&arg->common.value.integer, aml);
-		length = 4;
+		if (remaining >= 4) {
+			ACPI_MOVE_32_TO_64(&arg->common.value.integer, aml);
+			length = 4;
+		} else {
+			arg->common.value.integer = 0;
+			length = 0;
+			if (remaining > 0) {
+				partial_value = 0;
+				memcpy(&partial_value, aml, remaining);
+				arg->common.value.integer = partial_value;
+				length = remaining;
+			}
+		}
 		break;
 
 	case ARGP_QWORDDATA:
@@ -420,8 +449,19 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
 		/* Get 8 bytes from the AML stream */
 
 		opcode = AML_QWORD_OP;
-		ACPI_MOVE_64_TO_64(&arg->common.value.integer, aml);
-		length = 8;
+		if (remaining >= 8) {
+			ACPI_MOVE_64_TO_64(&arg->common.value.integer, aml);
+			length = 8;
+		} else {
+			arg->common.value.integer = 0;
+			length = 0;
+			if (remaining > 0) {
+				partial_value = 0;
+				memcpy(&partial_value, aml, remaining);
+				arg->common.value.integer = partial_value;
+				length = remaining;
+			}
+		}
 		break;
 
 	case ARGP_CHARLIST:
@@ -434,10 +474,28 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,
 		/* Find the null terminator */
 
 		length = 0;
-		while (aml[length]) {
+		while ((length < remaining) && aml[length]) {
+			length++;
+		}
+		if (length < remaining) {
+
+			/* Account for the terminating null */
 			length++;
+		} else {
+			/*
+			 * No terminator found - add null at buffer boundary
+			 * and report a warning
+			 */
+			ACPI_WARNING((AE_INFO,
+				      "Invalid AML string: no null terminator, truncating at offset %u",
+				      (u32)(aml - parser_state->aml)));
+
+			/* Add null terminator at the boundary */
+			if (remaining > 0) {
+				aml[remaining - 1] = 0;
+				length = remaining;
+			}
 		}
-		length++;
 		break;
 
 	case ARGP_NAME:
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()

[Sasha Levin]

From: Weiming Shi <bestswngs@gmail.com>

[ Upstream commit f8d14b7bb0063bbbd86c0e4d73edb8cea7b362bc ]

acpi_ns_custom_package() unconditionally dereferences the first element
of the package to read the _BIX version number, without checking for
NULL:

    if ((*Elements)->Common.Type != ACPI_TYPE_INTEGER)

When firmware returns a _BIX package whose first element is an
unresolvable reference, ACPICA evaluates that entry to NULL.
acpi_ns_remove_null_elements() does not strip NULL entries for
ACPI_PTYPE_CUSTOM packages (fixed-position format would break if
elements were shifted), so acpi_ns_custom_package() sees the NULL
and causes a crash.

Add a NULL check for the first element (version field) before
dereferencing it. The caller then receives AE_AML_OPERAND_TYPE
instead of crashing.

Link: https://github.com/acpica/acpica/commit/f3f111b9013b
Reported-by: Xiang Mei <xmei5@asu.edu>
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/5674388.Sb9uPGUboI@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: ACPICA NULL Pointer Dereference in
`acpi_ns_custom_package()`

**Local tree:** Linux **6.18.44** (`v6.18.44`, `stable/linux-6.18.y`)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Parse the Subject Line
**Record:** `[ACPICA] [fix] NULL pointer dereference in
acpi_ns_custom_package()` — ACPI namespace package validation for
predefined methods.

### Step 1.2: Parse All Commit Message Tags
**Record:**
- **Link:** https://github.com/acpica/acpica/commit/f3f111b9013b
  (upstream ACPICA commit)
- **Reported-by:** Xiang Mei \<xmei5@asu.edu\>
- **Reported-by:** Weiming Shi \<bestswngs@gmail.com\> (two independent
  reporters)
- **Signed-off-by:** Rafael J. Wysocki \<rafael.j.wysocki@intel.com\>
  (ACPI maintainer)
- **Link:** https://patch.msgid.link/5674388.Sb9uPGUboI@rafael.j.wysocki
- No `Fixes:` tag (expected for manual review)
- No `Cc: stable@vger.kernel.org` (expected)
- Notable: two real-world reporters; no syzbot

### Step 1.3: Analyze the Commit Body Text
**Record:**
- **Bug:** `acpi_ns_custom_package()` dereferences `(*elements)` to read
  the `_BIX` version field without checking for NULL.
- **Trigger:** Firmware returns a `_BIX` package whose first element is
  an unresolvable reference → evaluates to NULL.
  `acpi_ns_remove_null_elements()` intentionally does not strip NULLs
  from `ACPI_PTYPE_CUSTOM` packages (fixed-position semantics).
- **Symptom:** Kernel crash (NULL pointer dereference) instead of a
  controlled validation error.
- **Fix behavior:** Return `AE_AML_OPERAND_TYPE` with a warning,
  matching existing invalid-type handling.
- **Version info:** None specified; bug is in long-standing code.

### Step 1.4: Detect Hidden Bug Fixes
**Record:** Not hidden — explicitly labeled as a NULL pointer
dereference fix. Clear bug-fix commit.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory the Changes
**Record:**
- **Files:** `drivers/acpi/acpica/nsprepkg.c` (+7 lines, 0 removed)
- **Function modified:** `acpi_ns_custom_package()`
- **Scope:** Single-file, surgical fix

### Step 2.2: Understand the Code Flow Change
**Record:**
- **Hunk (before):** Immediately dereferences `(*elements)->common.type`
  to validate the version integer.
- **Hunk (after):** Adds `if (!(*elements))` guard with
  `ACPI_WARN_PREDEFINED` and early return of `AE_AML_OPERAND_TYPE`
  before any dereference.
- **Path affected:** Predefined-method package validation for `_BIX`
  (`ACPI_PTYPE_CUSTOM`).

### Step 2.3: Identify the Bug Mechanism
**Record:**
- **Category:** NULL pointer dereference (memory safety)
- **Mechanism:** Missing NULL check before pointer dereference on
  package element array; NULL elements are intentionally preserved for
  custom fixed-position packages.

### Step 2.4: Assess the Fix Quality
**Record:**
- **Quality:** Obviously correct — mirrors the existing invalid-type
  error path directly below it.
- **Minimal:** 7 lines, no unrelated changes.
- **Regression risk:** Very low — converts a crash into the same error
  status (`AE_AML_OPERAND_TYPE`) already used for wrong element types;
  caller already handles this status for repair/fallback.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame the Changed Lines
**Record:** Buggy dereference introduced in commit `7952d40240855` (Bob
Moore, 2016-05-05): "ACPICA: ACPI 6.0: Update _BIX support for new
package element". Present in this tree since at least 2016.

### Step 3.2: Follow the Fixes: Tag
**Record:** No `Fixes:` tag present — not applicable.

### Step 3.3: Check File History for Related Changes
**Record:** Recent `nsprepkg.c` history is mostly copyright updates. No
related NULL-check fixes for this function. Fix commit on mainline:
`f8d14b7bb0063` (May 27, 2026). Standalone — not part of a dependent
series for this specific fix (appeared as patch 21/27 in a larger ACPICA
merge, but the diff is self-contained).

### Step 3.4: Check the Author's Other Commits
**Record:** Author Weiming Shi reported the bug; commit committed by
Rafael J. Wysocki (ACPI subsystem maintainer). Strong subsystem
ownership signal.

### Step 3.5: Check for Dependent/Prerequisite Commits
**Record:** No dependencies. `acpi_ns_custom_package()`,
`acpi_ns_remove_null_elements()`, and `_BIX`/`ACPI_PTYPE_CUSTOM`
definitions all exist in this tree. `git apply --check` confirms clean
apply.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Find the Original Patch Discussion
**Record:**
- `b4 dig -c f8d14b7bb0063`: Found at
  https://patch.msgid.link/5674388.Sb9uPGUboI@rafael.j.wysocki
- `b4 dig -a`: Two submission contexts — standalone v1 from Weiming Shi
  (2026-03-22) and inclusion in Rafael's ACPICA v1 27-patch series
  (2026-05-27). Committed version matches the latter.
- Lore thread content could not be fetched (Anubis bot protection on
  lore.kernel.org).

### Step 4.2: Check Who Reviewed the Patch
**Record:** `b4 dig -w` recipients: Rafael J. Wysocki, linux-
acpi@vger.kernel.org, LKML, Saket Dumbre, Pawel Chmielewski (Intel ACPI
team). Appropriate maintainer coverage.

### Step 4.3: Search for the Bug Report
**Record:** Two `Reported-by` tags from researchers who found the crash
with broken `_BIX` firmware. GitHub ACPICA commit confirms same
mechanism. No syzbot report.

### Step 4.4: Check for Related Patches and Series
**Record:** Fix is standalone (7-line diff). Being patch 21/27 in a
merge series does not create a functional dependency on the other 26
patches.

### Step 4.5: Check Stable Mailing List History
**Record:** Could not search lore stable list (bot protection). No
evidence found that this was explicitly rejected for stable.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Identify Key Functions in the Diff
**Record:** `acpi_ns_custom_package()` (modified)

### Step 5.2: Trace Callers
**Record:**
- `acpi_ns_check_package()` → case `ACPI_PTYPE_CUSTOM` →
  `acpi_ns_custom_package()` (`nsprepkg.c:108-110`)
- `acpi_ns_check_package()` called from `acpi_ns_check_return_value()`
  (`nspredef.c:136`)
- `acpi_ns_check_return_value()` called from `acpi_ns_evaluate()`
  (`nseval.c:261`)
- Reaches `acpi_evaluate_object()` — used by `drivers/acpi/battery.c`
  for `_BIX` evaluation (`battery.c:546-548`)

### Step 5.3: Trace Callees
**Record:** After version check, calls
`acpi_ns_check_package_elements()` which uses
`acpi_ns_check_object_type()` — that function already handles NULL
objects safely at `type_error_exit` (`nspredef.c:248-252`). The bug is
specifically in the direct dereference before that path.

### Step 5.4: Follow the Call Chain (Bug Reachability)
**Record:**
```
acpi_battery_get_info()
  → acpi_evaluate_object("_BIX")
    → acpi_ns_evaluate()
      → acpi_ns_check_return_value()
        → acpi_ns_check_package()
          → acpi_ns_custom_package()  [CRASH without fix]
```
Reachable during normal battery driver operation on any system with
`_BIX` and broken firmware. Not config-obscure — ACPI battery is
standard on laptops.

### Step 5.5: Search for Similar Patterns
**Record:** `acpi_ns_remove_null_elements()` explicitly excludes
`ACPI_PTYPE_CUSTOM` from NULL stripping (`nsrepair.c:457-472`, default
case returns without modification). This design choice makes the NULL
check in `acpi_ns_custom_package()` necessary and consistent.

---

## PHASE 6: CROSS-REFERENCING AGAINST THE LOCAL TREE

### Step 6.1: Does the Buggy Code Exist in This Tree?
**Record:** **YES.** `drivers/acpi/acpica/nsprepkg.c:634` still has `if
((*elements)->common.type != ACPI_TYPE_INTEGER)` without a prior NULL
check. Fix commit `f8d14b7bb0063` is **NOT** an ancestor of HEAD (`fix
NOT in tree`).

### Step 6.2: Check for Backport Complications
**Record:** `git apply --check` on the mainline patch: **APPLIES
CLEANLY**. No conflicts expected. File has not been structurally
refactored around this function.

### Step 6.3: Check if Related Fixes Are Already Here
**Record:** No prior fix for this specific bug. Other ACPICA NULL-deref
fixes exist in the tree (e.g., `acpi_ev_address_space_dispatch`) but not
for `acpi_ns_custom_package`.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: Identify the Subsystem and Its Criticality
**Record:** **ACPI/ACPICA** — core firmware interface subsystem.
**Criticality: CORE** — affects all ACPI-enabled x86/ARM systems during
method evaluation.

### Step 7.2: Assess Subsystem Activity
**Record:** Actively maintained; ACPICA regularly synced. The bug
predates recent churn — present since 2016 `_BIX` support was added.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Determine Who Is Affected
**Record:** Systems with ACPI battery support and firmware exposing
`_BIX` with a broken/unresolvable first package element. Affects
laptop/desktop users with ACPI batteries — a large population, though
trigger requires specific broken firmware.

### Step 8.2: Determine the Trigger Conditions
**Record:** Evaluating `_BIX` when firmware returns a package whose
version field (element 0) is an unresolvable reference → NULL. Triggered
during battery info queries (boot and periodic updates). Does not
require privileged user action beyond normal system operation.

### Step 8.3: Determine the Failure Mode Severity
**Record:** **CRITICAL** — NULL pointer dereference in kernel context →
kernel oops/panic. With the fix: controlled `AE_AML_OPERAND_TYPE` return
→ battery driver falls back to `_BIF` (`battery.c:541-567`).

### Step 8.4: Calculate Risk-Benefit Ratio
**Record:**
- **Benefit:** HIGH — prevents kernel crash on broken firmware; enables
  graceful degradation to `_BIF`.
- **Risk:** VERY LOW — 7-line NULL guard using existing error-return
  pattern.
- **Ratio:** Strongly favors backport.

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Compile the Evidence

**FOR backporting:**
- Real NULL pointer dereference → kernel crash
- Two independent reporters
- Small (7 lines), obviously correct fix
- Applies cleanly to 6.18.y
- Bug present since 2016 in this tree
- ACPI maintainer committed the fix
- Graceful error path already exists in callers (`AE_AML_OPERAND_TYPE`
  handled in `nspredef.c:141-144`; battery driver falls back to `_BIF`)
- No new APIs or features

**AGAINST backporting:**
- Requires specific broken `_BIX` firmware (not universal)
- No syzbot/fuzzer confirmation
- Lore review thread not readable (bot protection)

**Unresolved:** Exact crash stack traces from reporters not available;
lore discussion content unverified.

### Step 9.2: Apply the Stable Rules Checklist
1. Obviously correct and tested? **PASS** — minimal NULL guard;
   committed by maintainer; two reporters.
2. Fixes a real bug affecting users? **PASS** — NULL deref on `_BIX`
   evaluation with broken firmware.
3. Important issue? **PASS** — kernel crash (CRITICAL severity).
4. Small and contained? **PASS** — 7 lines, one function, one file.
5. No new features or APIs? **PASS** — defensive check only.
6. Can apply to the local tree? **PASS** — buggy code present; patch
   applies cleanly.

### Step 9.3: Check for Exception Categories
**Record:** Not a device-ID/quirk/DT/build/doc exception — standard bug
fix.

### Step 9.4: Decision Rationale
This is a textbook stable backport: a long-standing NULL pointer
dereference in core ACPI validation code, triggered by real broken
firmware on a common code path (battery `_BIX` evaluation), fixed with a
minimal guard that converts a crash into an error code the callers
already handle. The fix is absent from Linux 6.18.44 and applies without
modification.

---

## Verification

- **[Phase 1]** Parsed subject, tags, body; identified two Reported-by,
  maintainer SOB, ACPICA upstream link
- **[Phase 2]** Diff: +7 lines in `acpi_ns_custom_package()`, adds NULL
  check before dereference
- **[Phase 3]** `git blame`: buggy line from `7952d40240855` (2016);
  `git show 7952d40240855`: introduced `_BIX` custom package validation
- **[Phase 3]** `git log -20 -- nsprepkg.c`: no prior fix for this issue
- **[Phase 3]** `git show f8d14b7bb0063`: confirmed mainline fix commit
- **[Phase 3]** `git apply --check`: patch applies cleanly to 6.18.44
- **[Phase 3]** `git merge-base --is-ancestor f8d14b7bb0063 HEAD`: fix
  NOT in tree
- **[Phase 4]** `b4 dig -c f8d14b7bb0063`: lore URL found
- **[Phase 4]** `b4 dig -a`: v1 standalone + v1 21/27 in ACPICA series
- **[Phase 4]** `b4 dig -w`: Rafael Wysocki, linux-acpi, Intel team CC'd
- **[Phase 4]** WebFetch lore/GitHub: GitHub ACPICA commit readable;
  lore blocked by Anubis
- **[Phase 5]** Grep call chain: `acpi_ns_custom_package` →
  `acpi_ns_check_package` → `acpi_ns_check_return_value` →
  `acpi_ns_evaluate`
- **[Phase 5]** Read `battery.c:546-567`: `_BIX` evaluation and `_BIF`
  fallback confirmed
- **[Phase 5]** Read `nsrepair.c:457-472`: `ACPI_PTYPE_CUSTOM` excluded
  from NULL stripping (confirms commit message)
- **[Phase 5]** Read `nspredef.c:248-252`: `acpi_ns_check_object_type`
  already handles NULL safely elsewhere
- **[Phase 6]** `git describe HEAD`: v6.18.44
- **[Phase 6]** Read `nsprepkg.c:634`: buggy code confirmed present
- **[Phase 8]** Failure mode: NULL deref → kernel oops; with fix →
  `AE_AML_OPERAND_TYPE` → battery `_BIF` fallback

**YES**The background search finished: the fix (`f8d14b7bb0063`) is on
mainline but **not** in this **6.18.44** tree, and `git apply --check`
applies it cleanly.

**Verdict: YES** — backport this to stable. It’s a 7-line NULL guard in
`acpi_ns_custom_package()` that stops a kernel oops when broken firmware
returns a `_BIX` package with a NULL version element; callers already
handle the returned `AE_AML_OPERAND_TYPE` and the battery driver can
fall back to `_BIF`.

 drivers/acpi/acpica/nsprepkg.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/acpica/nsprepkg.c b/drivers/acpi/acpica/nsprepkg.c
index ca137ce5674fb..c32770570120a 100644
--- a/drivers/acpi/acpica/nsprepkg.c
+++ b/drivers/acpi/acpica/nsprepkg.c
@@ -631,6 +631,13 @@ acpi_ns_custom_package(struct acpi_evaluate_info *info,
 
 	/* Get version number, must be Integer */
 
+	if (!(*elements)) {
+		ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname,
+				      info->node_flags,
+				      "Return Package has a NULL version element"));
+		return_ACPI_STATUS(AE_AML_OPERAND_TYPE);
+	}
+
 	if ((*elements)->common.type != ACPI_TYPE_INTEGER) {
 		ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname,
 				      info->node_flags,
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: Fix condition check in acpi_ps_parse_loop()

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit 8de27e2d83c0d07ae9443c6304575b0609394bfd ]

Fix condition check for AML_ELSE_OP in acpi_ps_parse_loop() to prevent
out-of-bounds access.

Link: https://github.com/acpica/acpica/commit/3b537b92336e
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/1959692.tdWV9SEqCh@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: ACPICA Fix condition check in
acpi_ps_parse_loop()

**Local tree:** `stable/linux-6.18.y` at `v6.18.44` (Makefile: 6.18.44)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject Line
**Record:** `[ACPICA]` `[Fix]` — correct the `AML_ELSE_OP` condition
check in `acpi_ps_parse_loop()` to prevent out-of-bounds access.

### Step 1.2: Commit Message Tags
**Record:**
- **Link:** https://github.com/acpica/acpica/commit/3b537b92336e
  (upstream ACPICA commit)
- **Signed-off-by:** ikaros <void0red@gmail.com> (author)
- **Signed-off-by:** Rafael J. Wysocki <rafael.j.wysocki@intel.com>
  (ACPI maintainer)
- **Link:** https://patch.msgid.link/1959692.tdWV9SEqCh@rafael.j.wysocki
  (kernel submission; could not fetch — Anubis bot protection)
- No `Fixes:`, `Reported-by:`, `Cc: stable@vger.kernel.org`, `Tested-
  by:`, or `Reviewed-by:` tags
- Notable: Rafael Wysocki sign-off indicates ACPI maintainer acceptance
  for kernel integration

### Step 1.3: Commit Body Analysis
**Record:**
- **Bug:** After skipping a failed If/While block, the code checks
  `*walk_state->aml == AML_ELSE_OP` without verifying `walk_state->aml`
  is within the AML buffer.
- **Symptom:** Out-of-bounds read (1 byte past buffer end).
- **Root cause:** `acpi_ps_get_next_package_end()` can advance the AML
  pointer to or past `parser_state->aml_end` on malformed/truncated AML;
  the subsequent dereference is unchecked.
- **Version info:** None in commit message; upstream ACPICA issue #1078
  documents ASan reproduction.

### Step 1.4: Hidden Bug Fix Detection
**Record:** Not disguised — explicitly labeled a fix for an out-of-
bounds access. Genuine memory-safety bug fix.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Change Inventory
**Record:**
- **File:** `drivers/acpi/acpica/psloop.c` (+3 / -1 lines)
- **Function:** `acpi_ps_parse_loop()`
- **Scope:** Single-file, surgical fix in an error-recovery path

### Step 2.2: Code Flow Change
**Record:**
- **Before:** After skipping a failed If/While body, unconditionally
  dereferenced `*walk_state->aml` to test for `AML_ELSE_OP`.
- **After:** Only dereferences if `walk_state->aml <
  parser_state->aml_end` AND the byte equals `AML_ELSE_OP`.
- **Path affected:** Error recovery when `acpi_ps_get_arguments()` fails
  inside an If/While control structure during module-level ACPI table
  parsing.

### Step 2.3: Bug Mechanism
**Record:**
- **Category:** Buffer overflow / out-of-bounds read (memory safety)
- **Mechanism:** `acpi_ps_get_next_package_end()` returns a pointer past
  the package end. On malformed AML at the buffer boundary,
  `walk_state->aml` can equal or exceed `parser_state->aml_end`. The old
  code read one byte past the allocated AML buffer. The fix adds the
  same bounds guard used by the main parse loop at line 300.

### Step 2.4: Fix Quality
**Record:**
- **Quality:** Obviously correct; mirrors the existing
  `parser_state->aml < parser_state->aml_end` pattern at line 300.
- **Regression risk:** Very low — only skips the Else-block skip when
  already past the buffer end (correct behavior).
- **Red flags:** None.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:** Buggy line introduced in `5088814a6e931` ("ACPICA: AML
parser: attempt to continue loading table after error") by Erik Kaneda,
2018-06-01. Confirmed ancestor of HEAD. Present in `v6.18.44`.

### Step 3.2: Fixes: Tag
**Record:** N/A — no `Fixes:` tag. Upstream ACPICA issue #1078
references the bug; the introducing commit is `5088814a6e931` (2018).

### Step 3.3: Related File History
**Record:** Recent `psloop.c` history is copyright updates and unrelated
parser cleanups. No prior fix for this issue in this tree. The Else-skip
logic has been unchanged since 2018.

### Step 3.4: Author Context
**Record:** Author ikaros (void0red) reported the bug via ACPICA
fuzzing. Rafael Wysocki (ACPI maintainer) signed off. ACPICA maintainer
SaketADumbre merged upstream PR #1087 with positive review ("minimal but
the right changes").

### Step 3.5: Dependencies
**Record:** No dependencies. Standalone 3-line fix. No patch series.
Applies cleanly to current `psloop.c` in this tree.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original Discussion
**Record:** `b4 dig -c 3b537b92336e` failed — commit not in Linux git
history (ACPICA-only commit). Upstream discussion found at:
- ACPICA issue #1078: ASan heap-buffer-overflow at `psloop.c:569`
  (fuzzed AML via `acpiexec`)
- ACPICA PR #1087: merged 2026-02-21
- Kernel lore/patch.msgid.link blocked by Anubis — could not read thread

### Step 4.2: Reviewers
**Record:** Rafael Wysocki signed off (kernel ACPI maintainer).
SaketADumbre (ACPICA maintainer) reviewed and merged upstream. No NAKs
found.

### Step 4.3: Bug Report
**Record:** ACPICA issue #1078 — ASan READ of size 1 at address 0 bytes
past a 1293-byte heap region. Reproducible with fuzzed AML
(`fuzz_178.aml`). Severity: confirmed memory safety bug via sanitizer.

### Step 4.4: Related Patches
**Record:** Standalone fix. Not part of a multi-patch series.

### Step 4.5: Stable Mailing List
**Record:** Could not search lore (Anubis protection). No stable-
specific discussion found via other sources.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key Functions
**Record:** `acpi_ps_parse_loop()` — modified.
`acpi_ps_get_next_package_end()` — called just before the buggy check.

### Step 5.2: Callers
**Record:** `acpi_ps_parse_loop()` called from `acpi_ps_parse_aml()` in
`psparse.c:475`. Reachable during ACPI table loading and method
execution.

### Step 5.3: Callees
**Record:** `acpi_ps_get_arguments()`, `acpi_ps_complete_op()`,
`acpi_ps_get_next_package_end()`, `acpi_ut_pop_generic_state()`.

### Step 5.4: Call Chain (Reachability)
**Record:**
```
Boot: acpi_ns_load_table() → acpi_ns_parse_table() →
acpi_ns_execute_table()
  → acpi_ps_execute_table() [sets ACPI_METHOD_MODULE_LEVEL]
  → acpi_ps_parse_aml() → acpi_ps_parse_loop()
```
Module-level ACPI table parsing (DSDT/SSDT) uses this error-recovery
path. Malformed firmware AML that fails If/While argument parsing can
reach the buggy dereference. **Reachable during boot on all ACPI-enabled
systems.**

### Step 5.5: Similar Patterns
**Record:** Main parse loop at line 300 uses `parser_state->aml <
parser_state->aml_end`. The Else check at line 428 was the only
unguarded dereference in this error path. No similar fix already present
in this tree (`git log -S 'walk_state->aml <'` returned nothing).

---

## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE

### Step 6.1: Buggy Code Exists?
**Record:** **YES.** Line 428 in `drivers/acpi/acpica/psloop.c` has the
unguarded `if (*walk_state->aml == AML_ELSE_OP)`. Confirmed in
`v6.18.44` tag. Bug present since 2018 (commit `5088814a6e931`).

### Step 6.2: Backport Complications
**Record:** **Clean apply expected.** File structure unchanged around
the hunk. No conflicting recent changes in this area.

### Step 6.3: Related Fixes Already Present?
**Record:** **No.** Fix not in this tree. `grep` for the bounds-check
pattern returns no matches.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: Subsystem Criticality
**Record:** **ACPI / ACPICA** — **CORE**. ACPI table parsing runs at
boot on essentially all x86 and many ARM systems. Affects firmware table
loading.

### Step 7.2: Subsystem Activity
**Record:** Active — regular ACPICA syncs and copyright updates, but
this code path has been stable since 2018.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who Is Affected
**Record:** All systems with ACPI enabled that load AML tables
containing If/While constructs. Trigger requires malformed ACPI AML
(common in buggy firmware) combined with a parse failure in the If/While
predicate.

### Step 8.2: Trigger Conditions
**Record:**
- If/While argument parsing fails during module-level table load
- `acpi_ps_get_next_package_end()` advances AML pointer to or past
  buffer end
- Unprivileged users cannot directly inject ACPI tables, but **malicious
  or buggy firmware ACPI tables** can trigger this at boot
- Likelihood: Low in practice, but the error-recovery path exists
  specifically for malformed AML

### Step 8.3: Failure Mode Severity
**Record:** Out-of-bounds read of 1 byte past AML buffer. **Severity:
HIGH** — potential kernel oops/crash or information leak. ASan-confirmed
heap-buffer-overflow.

### Step 8.4: Risk-Benefit
**Record:**
- **Benefit:** HIGH — prevents OOB read in core ACPI parser on malformed
  firmware tables
- **Risk:** VERY LOW — 3-line bounds check matching existing code
  pattern
- **Ratio:** Strongly favors backport

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence Summary

**FOR backport:**
- Real, ASan-confirmed out-of-bounds read
- Small (3 lines), obviously correct fix
- Bug present in this tree since 2018
- Affects core ACPI table loading at boot
- ACPI maintainer (Rafael Wysocki) signed off
- No dependencies; clean apply
- Error-recovery path designed for malformed AML — exactly when this bug
  triggers

**AGAINST backport:**
- Found via acpiexec fuzzing, not a reported production kernel crash
- Requires malformed ACPI + specific parse failure (narrow trigger)
- ACPI tables come from firmware, not direct userspace input (reduced
  attack surface, but buggy firmware is common)

**UNRESOLVED:**
- Kernel lore thread content (Anubis blocked)
- Whether any production kernel crash has been attributed to this
  specific bug

### Step 9.2: Stable Rules Checklist
1. Obviously correct and tested? **PASS** — matches existing bounds-
   check pattern; ASan-verified fix upstream
2. Fixes a real bug? **PASS** — confirmed OOB read
3. Important issue? **PASS** — memory safety in core boot path (HIGH)
4. Small and contained? **PASS** — 3 lines, one function
5. No new features/APIs? **PASS**
6. Can apply to local tree? **PASS** — buggy code confirmed present,
   clean apply expected

### Step 9.3: Exception Categories
**Record:** N/A — standard bug fix, not a device ID/quirk/DT/build/doc
exception.

### Step 9.4: Decision Rationale

This commit fixes a genuine out-of-bounds read in the ACPI AML parser's
error-recovery path. The bug has existed since 2018 and is present in
the local `6.18.44` tree. While the trigger requires malformed ACPI AML
with a failed If/While parse, that is precisely the scenario the 2018
error-recovery code was written to handle — and buggy ACPI firmware is a
known real-world problem. The fix is minimal, mirrors an existing bounds
check in the same function, and carries negligible regression risk.
Memory-safety fixes in core boot-path code are appropriate for stable
trees.

---

## Verification

- **[Phase 1]** Parsed commit message: subsystem ACPICA, action "Fix",
  OOB access described; Rafael Wysocki SOB confirmed
- **[Phase 1]** No Reported-by/syzbot; upstream ACPICA issue #1078
  provides bug report
- **[Phase 2]** Diff: +3/-1 in `psloop.c`, adds `walk_state->aml <
  parser_state->aml_end` guard before `AML_ELSE_OP` check
- **[Phase 3]** `git blame -L 428,428`: buggy line from `5088814a6e931`
  (2018-06-01)
- **[Phase 3]** `git show 5088814a6e931`: introduced Else-skip logic
  without bounds check
- **[Phase 3]** `git merge-base --is-ancestor 5088814a6e931 HEAD`:
  confirmed buggy commit in tree
- **[Phase 3]** `git log --oneline -20 -- drivers/acpi/acpica/psloop.c`:
  no prior fix for this issue
- **[Phase 3]** `git log -S 'walk_state->aml <' --
  drivers/acpi/acpica/`: no similar fix already applied
- **[Phase 4]** `b4 dig -c 3b537b92336e`: FAILED — commit not in Linux
  git
- **[Phase 4]** ACPICA issue #1078: ASan heap-buffer-overflow confirmed
  at psloop.c
- **[Phase 4]** ACPICA PR #1087: merged, maintainer approved minimal fix
- **[Phase 4]** lore.kernel.org / patch.msgid.link: BLOCKED by Anubis —
  UNVERIFIED for kernel list discussion
- **[Phase 5]** `acpi_ps_parse_loop` callers: `psparse.c:475` via
  `acpi_ps_parse_aml`
- **[Phase 5]** Call chain: `acpi_ns_parse_table` →
  `acpi_ns_execute_table` → `acpi_ps_execute_table` (sets
  `ACPI_METHOD_MODULE_LEVEL`) → `acpi_ps_parse_loop`
- **[Phase 5]** `nsparse.c:98`: `ACPI_METHOD_MODULE_LEVEL` set during
  table execution
- **[Phase 6]** `git describe HEAD`: v6.18.44 on `stable/linux-6.18.y`
- **[Phase 6]** `git show v6.18.44:drivers/acpi/acpica/psloop.c` lines
  426-432: buggy unguarded check confirmed
- **[Phase 6]** `grep` for fix pattern in tree: no matches — fix not
  present
- **[Phase 8]** Failure mode: OOB read, severity HIGH; trigger on
  malformed ACPI during boot table load

**YES**

 drivers/acpi/acpica/psloop.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
index c989cadf271ce..35111ff2526b1 100644
--- a/drivers/acpi/acpica/psloop.c
+++ b/drivers/acpi/acpica/psloop.c
@@ -425,7 +425,10 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
 
 					ACPI_ERROR((AE_INFO,
 						    "Skipping While/If block"));
-					if (*walk_state->aml == AML_ELSE_OP) {
+					if ((walk_state->aml <
+					     parser_state->aml_end)
+					    && (*walk_state->aml ==
+						AML_ELSE_OP)) {
 						ACPI_ERROR((AE_INFO,
 							    "Skipping Else block"));
 						walk_state->parser_state.aml =
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: validate handler object type in two places

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit c5296da2d516707862f8a2dbb4b515f777e5294f ]

ACPICA: validate handler object type in acpi_ev_has_default_handler()
and acpi_ev_find_region_handler().

Link: https://github.com/acpica/acpica/commit/f6fc648a1389
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/48111441.fMDQidcC6G@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: ACPICA handler object type validation

**Local tree:** `v6.18.44` (`stable/linux-6.18.y`, `make kernelversion`
= 6.18.44)
**Candidate commit (mainline):** `c5296da2d5167` — same diff as upstream
ACPICA `f6fc648a1389`
**Status in this tree:** Fix is **not** present; vulnerable code is
present.

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject line
**Record:** `[ACPICA] [validate] validate handler object type in
acpi_ev_has_default_handler() and acpi_ev_find_region_handler()`

### Step 1.2: Tags
**Record:**
- **Link:** https://github.com/acpica/acpica/commit/f6fc648a1389
- **Link:**
  https://patch.msgid.link/48111441.fMDQidcC6G@rafael.j.wysocki
- **Signed-off-by:** ikaros \<void0red@gmail.com\>
- **Signed-off-by:** Rafael J. Wysocki \<rafael.j.wysocki@intel.com\>
- No `Fixes:`, `Reported-by:`, `Cc: stable@vger.kernel.org`, `Reviewed-
  by:`, `Tested-by:`, or `Acked-by:` tags in the commit message
- Notable: upstream ACPICA issue #1132 documents an ASAN global-buffer-
  overflow; author is the issue reporter

### Step 1.3: Body text
**Record:**
- **Bug:** Handler linked lists walked via `common_notify.handler`
  assume every node is `ACPI_TYPE_LOCAL_ADDRESS_HANDLER`, but the list
  can contain objects of another type (corrupt/crafted ACPI state).
- **Symptom:** Out-of-bounds read when accessing
  `address_space.space_id` or `address_space.next` on a non-address-
  handler object (ASAN: global-buffer-overflow, 8-byte read in
  `AcpiEvFindRegionHandler`).
- **Root cause:** Missing type check before interpreting union members
  as `address_space` fields.
- **Version info:** None in commit message; upstream ACPICA fix dated
  2026-03-20.

### Step 1.4: Hidden bug fix?
**Record:** Yes — although the subject says “validate,” this is a
memory-safety fix preventing buffer overflow on handler-list traversal,
not cosmetic cleanup.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory
**Record:**
- **Files:** `drivers/acpi/acpica/evhandler.c` (+11 lines, 0 removed)
- **Functions modified:** `acpi_ev_has_default_handler()`,
  `acpi_ev_find_region_handler()`
- **Scope:** Single-file, surgical fix

### Step 2.2: Code flow change
**Record:**
- **Hunk 1 (`acpi_ev_has_default_handler`):** Before — walked handler
  list unconditionally using `address_space` fields. After — breaks loop
  if `handler_obj->common.type != ACPI_TYPE_LOCAL_ADDRESS_HANDLER`.
- **Hunk 2 (`acpi_ev_find_region_handler`):** Same type check added
  before `space_id` comparison and `next` pointer chase.
- **Paths affected:** Normal ACPI handler lookup during region
  initialization, handler installation, and namespace walks.

### Step 2.3: Bug mechanism
**Record:**
- **Category:** Memory safety / buffer overflow (out-of-bounds read)
- **Mechanism:** `union acpi_operand_object` is accessed as
  `address_space` without verifying `common.type`. Wrong type → wrong
  union layout → read past valid object memory via
  `address_space.space_id` (1 byte + padding) or `address_space.next`
  (8-byte pointer read per ASAN report).

### Step 2.4: Fix quality
**Record:**
- Fix is minimal and obviously correct: `common_notify.handler` is
  documented as the address-space handler list; only
  `ACPI_TYPE_LOCAL_ADDRESS_HANDLER` objects belong there.
- **Regression risk:** Very low. On type mismatch, loop terminates (same
  as list end). Worst case: handler not found where list was already
  corrupt — far safer than OOB read.
- No API changes, no locking changes.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:**
- `acpi_ev_has_default_handler` walk loop: `42f8fb75c43cc6` (Bob Moore,
  2013-01-11) — long-standing code
- `acpi_ev_find_region_handler`: `7b73806485ada` (Bob Moore,
  2015-12-29), introduced by `f31a99cefd05f` “Deploys
  acpi_ev_find_region_handler()”
- Bug predates 6.18.y branch by many years

### Step 3.2: Fixes: tag
**Record:** N/A — no `Fixes:` tag. Upstream ACPICA references GitHub
issue #1132 (ASAN global-buffer-overflow in `AcpiEvFindRegionHandler`).

### Step 3.3: Related file history
**Record:**
- Recent `evhandler.c` changes in this tree are copyright updates and
  unrelated fixes (e.g. `c27f3d011b085` I2C/GPIO race).
- `aa6abd2be1cc7` (2015) moved address handlers to
  `common_notify.handler` — architectural context, not the bug
  introducer.
- Fix is **standalone**; patch 18/27 in the ACPICA sync series but does
  not depend on patches 1–17.

### Step 3.4: Author context
**Record:** ikaros reported the upstream ACPICA bug and authored 14
hardening patches in the same series. Rafael J. Wysocki (ACPI
maintainer) signed off and committed to mainline.

### Step 3.5: Dependencies
**Record:** None. Uses `ACPI_TYPE_LOCAL_ADDRESS_HANDLER` (defined in
`include/acpi/actypes.h` as `0x18` in this tree). No prerequisite
commits required.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original discussion
**Record:**
- **URL:** https://patch.msgid.link/48111441.fMDQidcC6G@rafael.j.wysocki
- **Series:** `[PATCH v1 18/27]` in “ACPI: ACPICA 20260408” series by
  Rafael Wysocki
- **Revisions:** v1 only found via `b4 dig -a`
- No explicit stable nomination or NAK found in thread grep
- Cover letter groups this with other ikaros buffer-overflow / memory-
  safety hardening patches

### Step 4.2: Reviewers
**Record:** CC’d: Rafael J. Wysocki, linux-acpi, LKML, Saket Dumbre,
Pawel Chmielewski (Intel ACPICA maintainers). Signed-off-by from Rafael
J. Wysocki.

### Step 4.3: Bug report
**Record:**
- **GitHub issue #1132:** ASAN global-buffer-overflow, READ of 8 bytes
  in `AcpiEvFindRegionHandler`
- **Reproducer:** `./acpiexec -m issue26.aml` (crafted AML)
- **Severity:** Memory safety bug with concrete ASAN proof

### Step 4.4: Related patches
**Record:** Part of 27-patch ACPICA sync; 13 other ikaros hardening
patches in same series. This patch is independently applicable.

### Step 4.5: Stable list discussion
**Record:** No stable@vger.kernel.org discussion found for this specific
patch (lore blocked for web fetch; mbox grep found no “Cc: stable”).

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key functions
**Record:** `acpi_ev_has_default_handler()`,
`acpi_ev_find_region_handler()`

### Step 5.2: Callers
**Record:**
- `acpi_ev_has_default_handler()` ← `acpi_ev_initialize_op_regions()` in
  `evregion.c` (boot-time `_REG` method execution)
- `acpi_ev_find_region_handler()` ←
  - `acpi_ev_install_handler()` (namespace walk during handler install)
  - `acpi_ev_install_space_handler()` (handler installation)
  - `acpi_ev_region_init()` path in `evrgnini.c` (region attachment
    during init)
  - `dbdisply.c` (debug only, `CONFIG_ACPI_DEBUG`)

### Step 5.3: Callees
**Record:** Functions read `obj_desc->common_notify.handler`, then walk
list accessing `address_space.space_id`, `handler_flags`, `next`. No
allocation in the fixed loops.

### Step 5.4: Reachability
**Record:**
- **Boot path:** `tbxfload.c` → `acpi_ev_install_region_handlers()`;
  `nsinit.c` → `acpi_ev_initialize_op_regions()`
- **Runtime:** `acpi_install_address_space_handler()` used by EC, GPIO,
  I2C, PMIC, PCC, and platform drivers
- **Trigger:** Corrupt/crafted ACPI AML that leaves non-address-handler
  objects on the handler list
- **Userspace:** Not directly syscall-reachable, but ACPI tables are
  firmware-controlled; root can override tables on some systems

### Step 5.5: Similar patterns
**Record:** Other ACPICA code validates `common.type` before union
access (e.g. `exdump.c`, `utdecode.c`, `nsobject.c`). `evxfregn.c` and
`dbdisply.c` still walk handler lists without type checks — fix is
partial but addresses the two functions named in the ASAN stack trace.

---

## PHASE 6: CROSS-REFERENCE AGAINST LOCAL TREE (6.18.44)

### Step 6.1: Buggy code present?
**Record:** **Yes.** Current `evhandler.c` lines 132–141 and 294–305
lack type validation. Bug present since at least 2013/2015.

### Step 6.2: Backport complications
**Record:** **Clean apply expected.** Mainline diff applies identically
to this tree’s `evhandler.c` (verified via `git show c5296da2d5167`
against current file).

### Step 6.3: Related fixes already present?
**Record:** **No.** `git grep 'validate handler object type'` returns
nothing in this tree. Fix exists on `all-next` as `c5296da2d5167` but
not on `stable/linux-6.18.y` at `v6.18.44`.

---

## PHASE 7: SUBSYSTEM CONTEXT

### Step 7.1: Subsystem and criticality
**Record:** **ACPI / ACPICA events subsystem** — **CORE** (affects all
ACPI-enabled x86/ARM systems at boot and during device operation).

### Step 7.2: Activity
**Record:** Actively maintained; periodic ACPICA upstream syncs. Long-
standing handler-list code with recent hardening focus from fuzzing.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who is affected
**Record:** All systems with `CONFIG_ACPI` during ACPI table load,
operation-region initialization, and address-space handler installation.

### Step 8.2: Trigger conditions
**Record:** Handler list containing a
non-`ACPI_TYPE_LOCAL_ADDRESS_HANDLER` object — demonstrated with crafted
AML (`issue26.aml`). Uncommon in the field but plausible with
malicious/corrupt ACPI tables or interpreter bugs. Requires ACPI
processing context (boot or module load), not arbitrary unprivileged
syscall.

### Step 8.3: Failure mode severity
**Record:** Out-of-bounds **read** (8 bytes) → kernel oops/crash or
information leak. **Severity: HIGH** (memory safety in core boot path).

### Step 8.4: Risk-benefit
**Record:**
- **Benefit:** HIGH — prevents OOB read in widely used ACPI core code
- **Risk:** VERY LOW — 11-line defensive check, ACPI maintainer-reviewed
- **Ratio:** Strong benefit, minimal risk

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence summary

**FOR backport:**
- ASAN-confirmed global-buffer-overflow (upstream issue #1132)
- Buggy code present in 6.18.44 since 2013/2015
- Small, surgical, standalone fix (+11 lines, one file)
- ACPI maintainer signed off
- Affects boot-time and runtime ACPI handler paths
- Consistent with ACPICA hardening pattern (type check before union
  access)

**AGAINST backport:**
- Reproducer uses crafted AML via `acpiexec` — field trigger frequency
  uncertain
- Fix does not cover all similar walks (`evxfregn.c`, `dbdisply.c`) —
  incomplete hardening
- Part of larger 27-patch series (though this patch is independent)

**Unresolved:**
- No kernel-runtime reproducer confirmed (only upstream `acpiexec` tool)
- No explicit stable nomination in mailing list thread

### Step 9.2: Stable rules checklist
1. Obviously correct and tested? **PASS** — logic is straightforward;
   ASAN-tested upstream; maintainer SOB
2. Fixes a real bug affecting users? **PASS** — ASAN OOB read with
   concrete reproducer
3. Important issue? **PASS** — memory safety in ACPI core (HIGH
   severity)
4. Small and contained? **PASS** — 11 lines, one file, two functions
5. No new features or APIs? **PASS** — defensive validation only
6. Can apply to local tree? **PASS** — clean apply to 6.18.44

### Step 9.3: Exception categories
**Record:** None (not device ID, quirk, DT, build, or docs). Qualifies
as a core memory-safety bug fix.

### Step 9.4: Decision rationale
For **this** 6.18.y tree, the vulnerable handler-list walk code exists
and is reachable during ACPI initialization and handler management. The
fix prevents a demonstrated out-of-bounds read with negligible
regression risk. Incomplete coverage of similar walks elsewhere does not
diminish the value of fixing the two functions implicated in the ASAN
report.

---

## Verification

- **[Phase 1]** Parsed subject, tags, body from commit `c5296da2d5167`
  and user-provided message
- **[Phase 1]** Fetched upstream ACPICA commit and issue #1132 from
  GitHub — confirmed ASAN global-buffer-overflow
- **[Phase 2]** Analyzed diff: +11 lines in `evhandler.c`, two type-
  check hunks
- **[Phase 3]** `git blame`: buggy loops from 2013 and 2015
- **[Phase 3]** `git show aa6abd2be1cc7`: `common_notify.handler` used
  for address-space handlers since 2015
- **[Phase 3]** No `Fixes:` tag to follow
- **[Phase 3]** Fix not in stable tree; present on `all-next` as
  `c5296da2d5167`
- **[Phase 4]** `b4 dig -c c5296da2d5167`: found lore thread at
  patch.msgid.link
- **[Phase 4]** `b4 dig -a`: v1, patch 18/27 in ACPICA 20260408 series
- **[Phase 4]** `b4 dig -w`: Rafael Wysocki, linux-acpi, Intel
  maintainers CC’d
- **[Phase 4]** Downloaded mbox; grep found no stable nomination or NAK
  for this patch
- **[Phase 5]** `grep` callers: `evregion.c`, `evrgnini.c`,
  `evhandler.c`, `dbdisply.c`
- **[Phase 5]** Traced boot path: `tbxfload.c` →
  `acpi_ev_install_region_handlers()`, `nsinit.c` →
  `acpi_ev_initialize_op_regions()`
- **[Phase 5]** `grep acpi_install_address_space_handler`: used by EC,
  GPIO, I2C, PMIC, platform drivers
- **[Phase 6]** `git describe HEAD`: v6.18.44 on `stable/linux-6.18.y`
- **[Phase 6]** Read current `evhandler.c`: vulnerable code confirmed at
  lines 132–141, 294–305
- **[Phase 6]** `git show c5296da2d5167`: diff applies cleanly to
  current file
- **[Phase 6]** `grep 'validate handler object type'`: no match in tree
- **[Phase 8]** GitHub issue #1132: ASAN READ 8 bytes, reproducer
  `acpiexec -m issue26.aml`

---

**YES**The background `git log --grep` search timed out on this repo, so
I killed it and used targeted lookups instead (`b4 dig`, `git show
c5296da2d5167`, direct file reads). That was enough to finish the
analysis.

**Verdict for 6.18.44:** backport **YES** — the fix prevents an ASAN-
confirmed out-of-bounds read when walking ACPI address-space handler
lists, and it applies cleanly as an 11-line change to `evhandler.c`.

 drivers/acpi/acpica/evhandler.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/acpi/acpica/evhandler.c b/drivers/acpi/acpica/evhandler.c
index 5a35dae945e20..f16c1148e602e 100644
--- a/drivers/acpi/acpica/evhandler.c
+++ b/drivers/acpi/acpica/evhandler.c
@@ -130,6 +130,14 @@ acpi_ev_has_default_handler(struct acpi_namespace_node *node,
 		/* Walk the linked list of handlers for this object */
 
 		while (handler_obj) {
+
+			/* Validate handler object type before accessing fields */
+
+			if (handler_obj->common.type !=
+			    ACPI_TYPE_LOCAL_ADDRESS_HANDLER) {
+				break;
+			}
+
 			if (handler_obj->address_space.space_id == space_id) {
 				if (handler_obj->address_space.handler_flags &
 				    ACPI_ADDR_HANDLER_DEFAULT_INSTALLED) {
@@ -292,6 +300,9 @@ union acpi_operand_object *acpi_ev_find_region_handler(acpi_adr_space_type
 	/* Walk the handler list for this device */
 
 	while (handler_obj) {
+		if (handler_obj->common.type != ACPI_TYPE_LOCAL_ADDRESS_HANDLER) {
+			break;
+		}
 
 		/* Same space_id indicates a handler is installed */
 
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: add boundary checks in two places

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit bdc35754012906dbf094be104b103ca3adfef6f7 ]

Add boundary checks in acpi_ps_get_next_namestring() and
acpi_ps_peek_opcode() to prevent out-of-bounds access.

Link: https://github.com/acpica/acpica/commit/cfdc96896d8d
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/5180044.0VBMTVartN@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

The background searches finished and matched what we already found:

- **Author/grep search on stable** — No hits in linux-6.18.y; the fix
  isn’t in this tree yet.
- **linux-pm web search** — Confirmed the commit lives on Rafael’s
  linux-pm `master` branch; we already identified it as `bdc3575401290`.

The earlier analysis stands: this is a small, self-contained ACPI parser
OOB-read fix that applies cleanly to 6.18.44 and should be backported.

**YES**

 drivers/acpi/acpica/psargs.c  | 18 +++++++++++++++++-
 drivers/acpi/acpica/psparse.c |  6 ++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 34d887e2211ac..a7293332197aa 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -148,10 +148,16 @@ char *acpi_ps_get_next_namestring(struct acpi_parse_state *parser_state)
 
 	/* Point past any namestring prefix characters (backslash or carat) */
 
-	while (ACPI_IS_ROOT_PREFIX(*end) || ACPI_IS_PARENT_PREFIX(*end)) {
+	while (end < parser_state->aml_end &&
+	       (ACPI_IS_ROOT_PREFIX(*end) || ACPI_IS_PARENT_PREFIX(*end))) {
 		end++;
 	}
 
+	if (end >= parser_state->aml_end) {
+		parser_state->aml = parser_state->aml_end;
+		return_PTR(NULL);
+	}
+
 	/* Decode the path prefix character */
 
 	switch (*end) {
@@ -176,6 +182,11 @@ char *acpi_ps_get_next_namestring(struct acpi_parse_state *parser_state)
 
 		/* Multiple name segments, 4 chars each, count in next byte */
 
+		if ((end + 1) >= parser_state->aml_end) {
+			parser_state->aml = parser_state->aml_end;
+			return_PTR(NULL);
+		}
+
 		end += 2 + (*(end + 1) * ACPI_NAMESEG_SIZE);
 		break;
 
@@ -187,6 +198,11 @@ char *acpi_ps_get_next_namestring(struct acpi_parse_state *parser_state)
 		break;
 	}
 
+	if (end > parser_state->aml_end) {
+		parser_state->aml = parser_state->aml_end;
+		return_PTR(NULL);
+	}
+
 	parser_state->aml = end;
 	return_PTR((char *)start);
 }
diff --git a/drivers/acpi/acpica/psparse.c b/drivers/acpi/acpica/psparse.c
index b4f21a8988795..41587ee0a9c78 100644
--- a/drivers/acpi/acpica/psparse.c
+++ b/drivers/acpi/acpica/psparse.c
@@ -70,6 +70,9 @@ u16 acpi_ps_peek_opcode(struct acpi_parse_state * parser_state)
 	u16 opcode;
 
 	aml = parser_state->aml;
+	if (aml >= parser_state->aml_end) {
+		return (0xFFFF);
+	}
 	opcode = (u16) ACPI_GET8(aml);
 
 	if (opcode == AML_EXTENDED_PREFIX) {
@@ -77,6 +80,9 @@ u16 acpi_ps_peek_opcode(struct acpi_parse_state * parser_state)
 		/* Extended opcode, get the second opcode byte */
 
 		aml++;
+		if (aml >= parser_state->aml_end) {
+			return (0xFFFF);
+		}
 		opcode = (u16) ((opcode << 8) | ACPI_GET8(aml));
 	}
 
-- 
2.53.0

[PATCH AUTOSEL 6.18] gpiolib: acpi: Add robust bounds-checking for GPIO pin resources

[Sasha Levin]

From: Marco Scardovi <scardracs@disroot.org>

[ Upstream commit dece79032f529d2c9fdbf63a9f2fc32244722775 ]

Ensure that GPIO pin resource arrays are safely bounded before accessing
indices. Add explicit bounds checking in acpi_request_own_gpiod(),
acpi_gpio_irq_is_wake(), and acpi_gpiochip_alloc_event() to prevent
out-of-bounds array reads if the ACPI namespace provides malformed or empty
pin tables.

This change addresses potential safety issues arising from
inconsistent or invalid ACPI pin tables. It does not alter functional
behavior in well-formed tables.

Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://patch.msgid.link/20260610154204.110379-2-scardracs@disroot.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

## Phase 1: Commit Message Forensics

### Step 1.1: Subject Line
**Record:** `[gpiolib: acpi] [add] Add robust bounds-checking for GPIO
pin resources` — defensive hardening in the ACPI GPIO core to validate
`pin_table` indices before array access.

### Step 1.2: Commit Message Tags
**Record:**
- **Acked-by:** Mika Westerberg `<mika.westerberg@linux.intel.com>`
  (GPIO/ACPI maintainer)
- **Link:**
  https://patch.msgid.link/20260610154204.110379-2-scardracs@disroot.org
- **Signed-off-by:** Marco Scardovi, Bartosz Golaszewski (gpiolib
  maintainer)
- **Assisted-by:** Antigravity:gemini-3.5-flash
- **No** Fixes:, Reported-by:, Tested-by:, Cc: stable@vger.kernel.org,
  syzbot links

Notable: maintainer ack, but no fuzzer report or explicit stable
nomination.

### Step 1.3: Commit Body Analysis
**Record:**
- **Bug:** Three functions access `agpio->pin_table[]` without verifying
  `pin_table_length` first.
- **Symptom:** Out-of-bounds array reads when ACPI firmware provides
  empty or malformed GPIO pin tables.
- **Failure mode:** OOB read of `pin_table`; no change for well-formed
  tables.
- **Root cause:** Missing bounds checks in helper functions
  extracted/consolidated over years; one lookup path (line 719) already
  checks, but event/wakeup helpers do not.

### Step 1.4: Hidden Bug Fix Detection
**Record:** Yes — labeled as “robust bounds-checking” but is a real
memory-safety fix (out-of-bounds read prevention), not cosmetic cleanup.

---

## Phase 2: Diff Analysis

### Step 2.1: Change Inventory
**Record:**
- **File:** `drivers/gpio/gpiolib-acpi-core.c` (+19 / -4, ~23 lines
  touched)
- **Functions:** `acpi_request_own_gpiod()`, `acpi_gpio_irq_is_wake()`,
  `acpi_gpiochip_alloc_event()`
- **Scope:** Single-file, surgical fix

### Step 2.2: Code Flow Changes
**Record:**
1. **`acpi_request_own_gpiod()`:** Before → directly indexed
   `agpio->pin_table[index]`. After → returns `ERR_PTR(-EINVAL)` if
   `index >= pin_table_length`, then accesses table.
2. **`acpi_gpio_irq_is_wake()`:** Before → read `pin_table[0]`
   unconditionally. After → returns `false` if `pin_table_length == 0`.
3. **`acpi_gpiochip_alloc_event()`:** Before → read `pin_table[0]` after
   IRQ-resource check. After → returns `AE_OK` early if
   `pin_table_length == 0`.

### Step 2.3: Bug Mechanism
**Record:** **Category:** Buffer overflow / out-of-bounds read.
**Mechanism:** `pin_table_length` can be 0 (or `index` can be out of
range) while code still indexes `pin_table[]`, reading memory past the
allocated ACPI resource buffer.

### Step 2.4: Fix Quality
**Record:** Obviously correct, minimal, matches existing pattern at line
719 in the same file. Low regression risk — only affects malformed/empty
tables; well-formed tables unchanged. `acpi_gpiochip_alloc_event()`
already treats most failures as non-fatal (`AE_OK`), consistent with new
early return.

---

## Phase 3: Git History Investigation

### Step 3.1: Blame
**Record:**
- `acpi_request_own_gpiod()` unbounded access since `2e2b496cebefb` (Nov
  2020)
- `acpi_gpio_irq_is_wake()` unbounded `[0]` access since
  `0c2cae09a765b1` (Mar 2022)
- `acpi_gpiochip_alloc_event()` unbounded `[0]` access since
  `6072b9dcf97870` (Mar 2014)
- All present in this 6.18.y tree

### Step 3.2: Fixes: Tag
**Record:** N/A — no Fixes: tag in commit message.

### Step 3.3: Related File History
**Record:** Recent related fix in same file: `f749b366b8e79` “Fix
potential out-of-boundary left shift” (backported to stable with `Cc:
stable`). This commit is patch 1/2 of a v6 series; patch 2/2 hardens the
OperationRegion handler separately and is **not** required for this
patch to apply or function.

### Step 3.4: Author Context
**Record:** Marco Scardovi is a contributor (Rockchip GPIO fixes); not
the subsystem maintainer. Patch was acked by Mika Westerberg.

### Step 3.5: Dependencies
**Record:** Standalone. No prerequisite commits. Patch 2/2 is
complementary but independent. Applies cleanly to current `gpiolib-acpi-
core.c` in this tree.

---

## Phase 4: Mailing List and External Research

### Step 4.1: Original Discussion
**Record:** Part of `[PATCH v6 0/2]` series submitted June 10, 2026.
Patch 1/2 is this commit. `b4 shazam` could not find it on lore (likely
too new for index). Web search found lkml/spinics archives confirming
content and v6 cover letter. lore.kernel.org direct fetch blocked by bot
protection.

### Step 4.2: Reviewers
**Record:** v6 cover letter CCs Mika Westerberg, Andy Shevchenko, Linus
Walleij, Bartosz Golaszewski, linux-gpio@, linux-acpi@. Acked-by from
Mika Westerberg in committed version.

### Step 4.3: Bug Reports
**Record:** No syzbot, bugzilla, or user crash reports. Issue identified
by code review / defensive analysis of ACPI edge cases.

### Step 4.4: Series Context
**Record:** 2-patch series. This patch covers
event/wakeup/`acpi_request_own_gpiod` paths. Patch 2/2 covers
OperationRegion handler bounds (not in this tree yet). This patch is
self-contained.

### Step 4.5: Stable List History
**Record:** No stable-list discussion found. Absence of `Cc: stable` is
expected per review instructions.

---

## Phase 5: Code Semantic Analysis

### Step 5.1: Key Functions
**Record:** `acpi_request_own_gpiod`, `acpi_gpio_irq_is_wake`,
`acpi_gpiochip_alloc_event`

### Step 5.2: Callers
**Record:**
- `acpi_gpiochip_alloc_event` → called from
  `acpi_gpiochip_request_interrupts()` via `acpi_walk_resources()` on
  `_AEI`
- `acpi_gpiochip_request_interrupts()` → called from
  `gpiochip_irqchip_add()` in `gpiolib.c` during every GPIO chip IRQ
  setup
- `acpi_request_own_gpiod` → called from `acpi_gpiochip_alloc_event()`
  (index 0) and OpRegion handler (index `i` in bounded loop at line
  1113)
- `acpi_gpio_irq_is_wake` → called from `acpi_gpiochip_alloc_event()`
  (line 445) and ACPI GPIO lookup callback (line 731, after existing
  bounds check at 719)

### Step 5.3: Callees
**Record:** `gpiochip_request_own_desc`, `acpi_gpio_in_ignore_list`,
`acpi_get_handle`, `gpiochip_lock_as_irq`, etc. — standard GPIO/ACPI
operations during probe and event registration.

### Step 5.4: Reachability
**Record:** Triggered during GPIO controller registration on **every
ACPI platform** at boot (`CONFIG_ACPI` + GPIO chip with IRQ support).
Not directly userspace-triggerable, but firmware ACPI tables are the
input. Malformed `_AEI` GPIO resources with `pin_table_length == 0` hit
`acpi_gpiochip_alloc_event` on every affected chip probe.

### Step 5.5: Similar Patterns
**Record:** Line 719 already has `if (pin_index >=
agpio->pin_table_length) return 1;` in the lookup path — this patch
closes the same gap in the event/wakeup helpers. OpRegion loop uses
`min_t(u16, agpio->pin_table_length, pin_index + bits)` but still calls
`acpi_request_own_gpiod` without its own index guard.

---

## Phase 6: Cross-Reference Against Local Tree

### Step 6.1: Buggy Code Present?
**Record:** **Yes.** Local tree is **v6.18.44** (`VERSION=6,
PATCHLEVEL=18, SUBLEVEL=44`). All three functions lack the proposed
bounds checks (verified by reading current file). Bug dates to 2014–2020
code still present.

### Step 6.2: Backport Complications
**Record:** **Clean apply expected.** Single hunk in one file, no
structural divergence. No conflicting recent changes in these functions.

### Step 6.3: Related Fixes Already Present?
**Record:** Partial protection exists in ACPI GPIO lookup (line 719) and
OpRegion loop (line 1113), but **not** in the three functions this
commit fixes. The proposed fix is **not** already present.

---

## Phase 7: Subsystem Context

### Step 7.1: Subsystem Criticality
**Record:** `drivers/gpio/gpiolib-acpi-core.c` — **IMPORTANT**
subsystem. ACPI GPIO core used on x86 laptops/servers and ACPI-enabled
ARM platforms during device enumeration and interrupt setup.

### Step 7.2: Activity
**Record:** Actively maintained; recent stable-relevant fixes in same
file (e.g., `f749b366` OOB/UB fix backported to stable).

---

## Phase 8: Impact and Risk Assessment

### Step 8.1: Who Is Affected
**Record:** ACPI systems with GPIO controllers (`CONFIG_ACPI` +
`CONFIG_GPIOLIB`). All such platforms traverse this code at GPIO chip
registration.

### Step 8.2: Trigger Conditions
**Record:** Malformed or empty ACPI GPIO pin tables in `_AEI` resources
or other GPIO resource descriptors. Uncommon but plausible with buggy
firmware. Not unprivileged-userspace-triggerable; firmware-dependent.

### Step 8.3: Failure Mode Severity
**Record:** Out-of-bounds kernel read → **MEDIUM-HIGH**. On KASAN
builds: detectable memory safety bug. On production: may read adjacent
memory (garbage pin number, possible mis-driven GPIO or further errors).
Unlikely to panic in all cases, but real safety defect in a core boot
path.

### Step 8.4: Risk-Benefit
**Record:**
- **Benefit:** Closes longstanding OOB-read holes in ACPI GPIO
  event/wakeup path; aligns with existing bounds check at line 719;
  precedent from `f749b366` in same file.
- **Risk:** Very low — ~15 lines of early-return guards, no API/behavior
  change for valid tables.
- **Ratio:** Favorable for stable.

---

## Phase 9: Final Synthesis

### Step 9.1: Evidence Summary

**FOR backport:**
- Real out-of-bounds read bug in core ACPI GPIO code present since
  2014–2020
- Affects boot-time GPIO/ACPI event setup on all ACPI platforms
- Small, surgical, maintainer-acked fix
- Buggy code confirmed in v6.18.44 tree; fix applies cleanly
- Consistent with prior stable backport of OOB fix in same file
  (`f749b366`)
- Defense-in-depth where partial checks already exist but are incomplete

**AGAINST backport:**
- No syzbot/user crash reports
- Requires malformed ACPI firmware (uncommon trigger)
- Patch 1/2 of a series (though standalone)
- Impact on production kernels without KASAN may be limited to reading
  garbage rather than immediate crash

**Unresolved:** No direct lore thread review comments retrieved (lore
blocked); no runtime crash evidence.

### Step 9.2: Stable Rules Checklist
1. Obviously correct and tested? **PASS** — straightforward bounds
   checks; maintainer acked
2. Fixes a real bug? **PASS** — OOB array access on empty/malformed pin
   tables
3. Important issue? **PASS** — memory safety / OOB read in core boot
   path (MEDIUM-HIGH severity)
4. Small and contained? **PASS** — one file, ~19 lines added
5. No new features/APIs? **PASS** — pure defensive validation
6. Can apply to local tree? **PASS** — buggy code present, clean apply
   expected

### Step 9.3: Exception Categories
**Record:** None (not device ID, quirk, DT, build, or docs). Standard
memory-safety bug fix.

### Step 9.4: Decision Rationale

For **this v6.18.44 tree**, the unbounded `pin_table[]` accesses have
been present for years in code that runs during GPIO chip registration
on every ACPI machine. The fix is minimal, obviously correct,
maintainer-reviewed, and closes a real out-of-bounds read class that
partial existing checks do not cover (especially
`acpi_gpiochip_alloc_event` reading `pin_table[0]` before any length
validation). While no crash report was found, stable trees routinely
accept such defensive fixes in core subsystems — particularly when a
nearly identical class of fix was already backported in the same file.
Risk of regression is negligible.

---

## Verification

- **[Phase 1]** Parsed commit message and tags from user-provided diff
- **[Phase 1]** Confirmed no Fixes:/Reported-by:/Cc: stable tags
- **[Phase 2]** Analyzed diff: 3 functions, +19/-4 lines in `gpiolib-
  acpi-core.c`
- **[Phase 3]** `git describe HEAD` → `v6.18.44-1-g2736c32da98b9`;
  Makefile → 6.18.44
- **[Phase 3]** `git blame` on lines 318–372: buggy code from 2014–2022
  commits, all in tree
- **[Phase 3]** `git show f749b366b8e79`: related OOB fix in same file,
  Cc: stable, already in tree
- **[Phase 3]** `git log --oneline -20 -- drivers/gpio/gpiolib-acpi-
  core.c`: no duplicate fix present
- **[Phase 4]** `b4 shazam` / `b4 dig`: patch not indexed on lore yet
- **[Phase 4]** Web search: confirmed v6 0/2 series, patch 1/2 content,
  maintainer CC list
- **[Phase 4]** WebFetch lore/patch.msgid.link: blocked/timeout — review
  comments unverified
- **[Phase 5]** `grep acpi_gpio_irq_is_wake`: callers at lines 445, 731
- **[Phase 5]** `grep acpi_gpiochip_request_interrupts`: called from
  `gpiolib.c:2131` during IRQ chip add
- **[Phase 5]** Read `gpiolib-acpi-core.c` lines 280–460, 700–750,
  1095–1200: confirmed missing bounds checks and existing partial checks
  at 719/1113
- **[Phase 6]** Read current tree code: all three functions lack
  proposed guards
- **[Phase 6]** Confirmed patch 2/2 (OpRegion) not in tree; patch 1/2 is
  independent
- **[Phase 7]** Subsystem: ACPI GPIO core, IMPORTANT criticality
- **[Phase 8]** Failure mode: OOB read, MEDIUM-HIGH; trigger: malformed
  ACPI firmware at boot

**YES**

 drivers/gpio/gpiolib-acpi-core.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/drivers/gpio/gpiolib-acpi-core.c b/drivers/gpio/gpiolib-acpi-core.c
index 8851e48669756..eb14351afef90 100644
--- a/drivers/gpio/gpiolib-acpi-core.c
+++ b/drivers/gpio/gpiolib-acpi-core.c
@@ -320,10 +320,17 @@ static struct gpio_desc *acpi_request_own_gpiod(struct gpio_chip *chip,
 						unsigned int index,
 						const char *label)
 {
-	int polarity = GPIO_ACTIVE_HIGH;
-	enum gpiod_flags flags = acpi_gpio_to_gpiod_flags(agpio, polarity);
-	unsigned int pin = agpio->pin_table[index];
+	enum gpiod_flags flags;
 	struct gpio_desc *desc;
+	unsigned int pin;
+	int polarity;
+
+	if (index >= agpio->pin_table_length)
+		return ERR_PTR(-EINVAL);
+
+	pin = agpio->pin_table[index];
+	polarity = GPIO_ACTIVE_HIGH;
+	flags = acpi_gpio_to_gpiod_flags(agpio, polarity);
 
 	desc = gpiochip_request_own_desc(chip, pin, label, polarity, flags);
 	if (IS_ERR(desc))
@@ -337,7 +344,12 @@ static struct gpio_desc *acpi_request_own_gpiod(struct gpio_chip *chip,
 static bool acpi_gpio_irq_is_wake(struct device *parent,
 				  const struct acpi_resource_gpio *agpio)
 {
-	unsigned int pin = agpio->pin_table[0];
+	unsigned int pin;
+
+	if (agpio->pin_table_length == 0)
+		return false;
+
+	pin = agpio->pin_table[0];
 
 	if (agpio->wake_capable != ACPI_WAKE_CAPABLE)
 		return false;
@@ -367,6 +379,9 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares,
 	if (!acpi_gpio_get_irq_resource(ares, &agpio))
 		return AE_OK;
 
+	if (agpio->pin_table_length == 0)
+		return AE_OK;
+
 	handle = ACPI_HANDLE(chip->parent);
 	pin = agpio->pin_table[0];
 
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit 0e2021f49e64b3c8a9aa880d0c62a218bfe147ce ]

Add overflow check for Index + Length to prevent integer overflow
when calculating the truncation length. This prevents negative
size parameter being passed to memcpy().

Link: https://github.com/acpica/acpica/commit/d281ec1ac84e
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/3760974.R56niFO833@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

The background author/search finished. A search for `ikaros`/`void0red`
in this tree only turned up unrelated error-path hardening commits
(hwmon, thermal, ACPICA debug checks, etc.) — not the MidOp overflow
fix. That fix exists only on master as `0e2021f49e64b` and is still
missing from `stable/linux-6.18.y` at v6.18.44.

That matches the earlier analysis: the vulnerable code is present, the
one-line patch applies cleanly, and the backport recommendation remains
**YES**.

 drivers/acpi/acpica/exoparg3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
index c8c8c4e49563e..df770f36b4d08 100644
--- a/drivers/acpi/acpica/exoparg3.c
+++ b/drivers/acpi/acpica/exoparg3.c
@@ -152,7 +152,7 @@ acpi_status acpi_ex_opcode_3A_1T_1R(struct acpi_walk_state *walk_state)
 
 		/* Truncate request if larger than the actual String/Buffer */
 
-		else if ((index + length) > operand[0]->string.length) {
+		else if ((index + length) > operand[0]->string.length || (index + length) < index) {	/* Check for overflow */
 			length =
 			    (acpi_size)operand[0]->string.length -
 			    (acpi_size)index;
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: Add package limit checks in parser functions

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit d27d48a528e437aed690f977e69a6fe73fe82ab5 ]

Add package limit checks in parser functions to prevent out-of-bounds
access.

Link: https://github.com/acpica/acpica/commit/b31b45af2122
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/3212937.CbtlEUcBR6@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

The background git searches finished. Both came back empty:

- No commit matching **"Add package limit"** in this tree
- No commits from author **ikaros**
- No related fixes for **"Clamp PackageEnd"**, **"package limit"**, or
  **"package end"**

That confirms the package-limit checks are not in **6.18.44** yet. The
earlier analysis stands: this is a small, maintainer-reviewed bounds-
check fix for a real ACPI parser OOB read, and it should be backported.

**YES**

 drivers/acpi/acpica/nsxfname.c |  4 ++++
 drivers/acpi/acpica/psargs.c   |  4 ++++
 drivers/acpi/acpica/psloop.c   | 25 +++++++++++++++++++++++++
 drivers/acpi/acpica/psparse.c  |  8 ++++++++
 4 files changed, 41 insertions(+)

diff --git a/drivers/acpi/acpica/nsxfname.c b/drivers/acpi/acpica/nsxfname.c
index 1db831545ec8c..821fb4930e9d8 100644
--- a/drivers/acpi/acpica/nsxfname.c
+++ b/drivers/acpi/acpica/nsxfname.c
@@ -512,6 +512,10 @@ acpi_status acpi_install_method(u8 *buffer)
 
 	parser_state.aml += acpi_ps_get_opcode_size(opcode);
 	parser_state.pkg_end = acpi_ps_get_next_package_end(&parser_state);
+	if ((parser_state.pkg_end > parser_state.aml_end) ||
+	    (parser_state.pkg_end < parser_state.aml)) {
+		return (AE_AML_PACKAGE_LIMIT);
+	}
 	path = acpi_ps_get_next_namestring(&parser_state);
 
 	method_flags = *parser_state.aml++;
diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 064652d11d9aa..34d887e2211ac 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -867,6 +867,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,
 
 		parser_state->pkg_end =
 		    acpi_ps_get_next_package_end(parser_state);
+		if ((parser_state->pkg_end > parser_state->aml_end)
+		    || (parser_state->pkg_end < parser_state->aml)) {
+			return_ACPI_STATUS(AE_AML_PACKAGE_LIMIT);
+		}
 		break;
 
 	case ARGP_FIELDLIST:
diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
index 35111ff2526b1..7c3caf0ccab62 100644
--- a/drivers/acpi/acpica/psloop.c
+++ b/drivers/acpi/acpica/psloop.c
@@ -361,6 +361,13 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
 					walk_state->parser_state.aml =
 					    acpi_ps_get_next_package_end
 					    (&walk_state->parser_state);
+					if ((walk_state->parser_state.aml >
+					     walk_state->parser_state.aml_end)
+					    || (walk_state->parser_state.aml <
+						walk_state->aml)) {
+						return_ACPI_STATUS
+						    (AE_AML_PACKAGE_LIMIT);
+					}
 					walk_state->aml =
 					    walk_state->parser_state.aml;
 				}
@@ -421,6 +428,14 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
 					parser_state->aml =
 					    acpi_ps_get_next_package_end
 					    (parser_state);
+					if ((parser_state->aml >
+					     parser_state->aml_end)
+					    || (parser_state->aml <
+						walk_state->control_state->
+						control.aml_predicate_start)) {
+						return_ACPI_STATUS
+						    (AE_AML_PACKAGE_LIMIT);
+					}
 					walk_state->aml = parser_state->aml;
 
 					ACPI_ERROR((AE_INFO,
@@ -436,6 +451,16 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
 						walk_state->parser_state.aml =
 						    acpi_ps_get_next_package_end
 						    (parser_state);
+						if ((walk_state->parser_state.
+						     aml >
+						     walk_state->parser_state.
+						     aml_end)
+						    || (walk_state->
+							parser_state.aml <
+							walk_state->aml)) {
+							return_ACPI_STATUS
+							    (AE_AML_PACKAGE_LIMIT);
+						}
 						walk_state->aml =
 						    parser_state->aml;
 					}
diff --git a/drivers/acpi/acpica/psparse.c b/drivers/acpi/acpica/psparse.c
index 55a416e56fd83..b4f21a8988795 100644
--- a/drivers/acpi/acpica/psparse.c
+++ b/drivers/acpi/acpica/psparse.c
@@ -300,6 +300,7 @@ acpi_ps_next_parse_state(struct acpi_walk_state *walk_state,
 {
 	struct acpi_parse_state *parser_state = &walk_state->parser_state;
 	acpi_status status = AE_CTRL_PENDING;
+	u8 *aml;
 
 	ACPI_FUNCTION_TRACE_PTR(ps_next_parse_state, op);
 
@@ -344,7 +345,14 @@ acpi_ps_next_parse_state(struct acpi_walk_state *walk_state,
 		 * Predicate of an IF was true, and we are at the matching ELSE.
 		 * Just close out this package
 		 */
+		aml = parser_state->aml;
+
 		parser_state->aml = acpi_ps_get_next_package_end(parser_state);
+		if ((parser_state->aml > parser_state->aml_end) ||
+		    (parser_state->aml < aml)) {
+			status = AE_AML_PACKAGE_LIMIT;
+			break;
+		}
 		status = AE_CTRL_PENDING;
 		break;
 
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit 945e87267cfd90937b3c637f87324cbb56998b72 ]

Fix use-after-free issue in acpi_ds_terminate_control_method() by
clearing references to method locals and arguments.

Link: https://github.com/acpica/acpica/commit/36f22a94cb1b
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/8730924.NyiUUSuA9g@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: ACPICA UAF in
`acpi_ds_terminate_control_method()`

**Local tree:** Linux **6.18.44** (`git describe HEAD` → `v6.18.44`,
`make kernelversion` → `6.18.44`)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: PARSE THE SUBJECT LINE
**Record:** `[ACPICA] [fix] use-after-free in
acpi_ds_terminate_control_method() when clearing references to method
locals/arguments`

### Step 1.2: PARSE ALL COMMIT MESSAGE TAGS
**Record:**
- **Link:** https://github.com/acpica/acpica/commit/36f22a94cb1b
  (upstream ACPICA commit)
- **Link:** https://patch.msgid.link/8730924.NyiUUSuA9g@rafael.j.wysocki
  (kernel submission; could not fetch)
- **Signed-off-by:** ikaros \<void0red@gmail.com\> (author)
- **Signed-off-by:** Rafael J. Wysocki \<rafael.j.wysocki@intel.com\>
  (ACPI maintainer)
- **Fixes:** #1119 (ACPICA GitHub issue, in upstream commit message)
- No Reported-by, Tested-by, Reviewed-by, Acked-by, or Cc: stable in the
  provided message
- Notable: Maintainer sign-off; upstream issue with ASAN reproduction

### Step 1.3: ANALYZE THE COMMIT BODY TEXT
**Record:**
- **Bug:** If `walk_state->return_desc` is a `RefOf` reference pointing
  at a method local or argument namespace node (embedded in
  `walk_state`), terminating the method deletes locals/args and later
  frees `walk_state`, leaving a dangling pointer in `return_desc`.
- **Symptom:** Heap use-after-free when `acpi_ns_resolve_references()`
  dereferences `node->object` during `acpi_evaluate_object()`.
- **Root cause:** `acpi_ds_method_data_delete_all()` and
  `acpi_ds_delete_walk_state()` invalidate nodes still referenced by
  `return_desc`.
- **Fix approach:** Before deleting locals/args, detect
  `ACPI_REFCLASS_REFOF` references to `walk_state->local_variables[]` or
  `walk_state->arguments[]`, drop the reference, and NULL `return_desc`.

### Step 1.4: DETECT HIDDEN BUG FIXES
**Record:** Not disguised — explicitly labeled as a use-after-free fix.
The mechanism is a classic dangling-pointer bug in interpreter teardown,
not cosmetic cleanup.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: INVENTORY THE CHANGES
**Record:**
- **Files:** `drivers/acpi/acpica/dsmethod.c` (+43 lines, 0 removed)
- **Function modified:** `acpi_ds_terminate_control_method()`
- **Scope:** Single-file, surgical fix in ACPI interpreter dispatch path

### Step 2.2: UNDERSTAND THE CODE FLOW CHANGE
**Record:**
- **Hunk (before):** On method termination, immediately calls
  `acpi_ds_method_data_delete_all(walk_state)` while
  `walk_state->return_desc` may still hold a `RefOf` pointer into
  `walk_state->local_variables[]` or `walk_state->arguments[]`.
- **Hunk (after):** Before `acpi_ds_method_data_delete_all()`, if
  `return_desc` is `ACPI_TYPE_LOCAL_REFERENCE` / `ACPI_REFCLASS_REFOF`
  and `reference.object` matches a local or argument node in this
  `walk_state`, call `acpi_ut_remove_reference()` and set `return_desc =
  NULL`.
- **Execution path:** Method termination during AML parse/execute
  (normal and error paths), always under interpreter lock.

### Step 2.3: IDENTIFY THE BUG MECHANISM
**Record:**
- **Category:** Memory safety — use-after-free (dangling pointer)
- **Mechanism:** `local_variables[]` and `arguments[]` are embedded in
  `struct acpi_walk_state` (`acstruct.h:66-67`). A `RefOf(LocalX)`
  return value stores a pointer to those nodes. After method termination
  frees `walk_state`, `acpi_ns_resolve_references()` at
  `nsxfeval.c:496-501` reads `node->object` from freed memory.

### Step 2.4: ASSESS THE FIX QUALITY
**Record:**
- Fix is minimal, localized, and logically correct for the identified
  failure mode.
- Regression risk is low: only affects the teardown path when
  `return_desc` references ephemeral local/arg nodes.
- Trade-off: dropping the reference yields no return value instead of a
  crash — acceptable vs. UAF, and explicit `Return(RefOf(Local))` paths
  are supposed to resolve references earlier in `dscontrol.c`.
- No API changes, no new features.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: BLAME THE CHANGED LINES
**Record:** Buggy teardown sequence dates to **2005-2006**
(`b229cf92eee616` / `^1da177e4c3f41` on
`acpi_ds_method_data_delete_all()` call). Long-present bug, not a recent
regression.

### Step 3.2: FOLLOW THE FIXES: TAG
**Record:** No `Fixes:` tag in the kernel commit message. Upstream
ACPICA commit references `Fixes: #1119`.

### Step 3.3: CHECK FILE HISTORY FOR RELATED CHANGES
**Record:** Related prior UAF fix in this tree: `6fcab27915439`
("ACPICA: Refuse to evaluate a method if arguments are missing") —
different bug, same subsystem, also UAF from AML evaluation. Another:
`470188b09e92d` (package copy UAF). This specific
`terminate_control_method` fix is **not** present in 6.18.44.

### Step 3.4: CHECK THE AUTHOR'S OTHER COMMITS
**Record:** Author ikaros reported ACPICA issue #1119. Rafael J. Wysocki
is ACPI maintainer and regularly syncs ACPICA fixes (e.g.,
`6fcab27915439`, `e2c80b3c23782`).

### Step 3.5: CHECK FOR DEPENDENT/PREREQUISITE COMMITS
**Record:** Standalone fix. No series dependencies. Applies to existing
`acpi_ds_terminate_control_method()` with only path adjustment
(`source/components/dispatcher/dsmethod.c` →
`drivers/acpi/acpica/dsmethod.c`).

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: FIND THE ORIGINAL PATCH DISCUSSION
**Record:** `b4 dig -c 36f22a94cb1b` failed — commit is upstream ACPICA
only, not in this kernel tree. `lore.kernel.org` returned 403.
`patch.msgid.link` blocked by bot protection. Upstream GitHub issue
#1119 provides full reproduction and ASAN stack trace.

### Step 4.2: CHECK WHO REVIEWED THE PATCH
**Record:** Could not verify via b4/lore. Upstream issue closed by Saket
Dumbre (ACPICA maintainer). Kernel commit signed by Rafael J. Wysocki.

### Step 4.3: SEARCH FOR THE BUG REPORT
**Record:** [ACPICA issue
#1119](https://github.com/acpica/acpica/issues/1119) — "Use-After-Free
in AcpiNsResolveReferences"
- **Reproducer:** `./acpiexec -m issue7.aml`
- **ASAN:** heap-use-after-free READ at `AcpiNsResolveReferences`
  (nsxfeval.c:692 upstream)
- **Free site:** `AcpiDsDeleteWalkState` during `AcpiPsParseAml`
- **Alloc site:** `AcpiDsCreateWalkState`
- Severity: reproducible memory corruption in ACPI method evaluation

### Step 4.4: CHECK FOR RELATED PATCHES AND SERIES
**Record:** Single-commit fix in upstream ACPICA. No multi-patch series.

### Step 4.5: CHECK STABLE MAILING LIST HISTORY
**Record:** Could not access lore (403). No stable-list discussion found
via available tools.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: IDENTIFY KEY FUNCTIONS IN THE DIFF
**Record:** `acpi_ds_terminate_control_method()` — only function
modified.

### Step 5.2: TRACE CALLERS
**Record:** Called from:
- `psxface.c:168` — internal method execution cleanup
- `psparse.c:434` — error path during thread creation
- `psparse.c:568` — normal method completion / error during parse
- `dsmethod.c:594` — nested method handling

All paths run during ACPI control method evaluation — core interpreter
hot path.

### Step 5.3: TRACE CALLEES
**Record:** Fix adds `acpi_ut_remove_reference()`; existing path calls
`acpi_ds_method_data_delete_all()`, namespace cleanup, mutex release,
thread count management.

### Step 5.4: FOLLOW THE CALL CHAIN
**Record:**
`acpi_evaluate_object()` → `acpi_ns_evaluate()` →
`acpi_ps_execute_method()` → `acpi_ps_parse_aml()` →
`acpi_ds_terminate_control_method()` → (later)
`acpi_ns_resolve_references()` on the return object.

Reachable whenever kernel code evaluates ACPI methods returning `RefOf`
references to locals/args without prior resolution — including firmware
AML during boot, suspend/resume, thermal, battery, and device
enumeration.

### Step 5.5: SEARCH FOR SIMILAR PATTERNS
**Record:** `dscontrol.c:236-254` and `dscontrol.c:264-286` already
resolve references on explicit `Return()`, but
`acpi_ds_restart_control_method()` (`dsmethod.c:658`) can propagate
unresolved `return_desc` from nested calls. The terminate-time guard
closes the gap.

---

## PHASE 6: CROSS-REFERENCING AGAINST THE LOCAL TREE

### Step 6.1: DOES THE BUGGY CODE EXIST IN THIS TREE?
**Record:** **YES.** `drivers/acpi/acpica/dsmethod.c:717-721` goes
directly to `acpi_ds_method_data_delete_all()` with no `return_desc`
guard. `local_variables[]` / `arguments[]` embedded in `walk_state` per
`acstruct.h:66-67`. `acpi_ns_resolve_references()` at
`nsxfeval.c:496-501` performs the dangling dereference. Fix is **not**
present (grep found no matching comment/pattern).

### Step 6.2: CHECK FOR BACKPORT COMPLICATIONS
**Record:** Expected **clean apply** with path adjustment only.
Insertion point at line 717 matches upstream hunk context exactly.
Upstream raw patch failed only due to path mismatch
(`source/components/dispatcher/` vs `drivers/acpi/acpica/`).

### Step 6.3: CHECK IF RELATED FIXES ARE ALREADY HERE
**Record:** No equivalent fix for this specific UAF. Prior ACPICA UAF
fixes (`6fcab27915439`, `470188b09e92d`) address different bugs.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: IDENTIFY THE SUBSYSTEM AND ITS CRITICALITY
**Record:** **ACPI / ACPICA interpreter** — **CORE**. Affects all ACPI-
enabled systems (x86, ARM servers/laptops, etc.).

### Step 7.2: ASSESS SUBSYSTEM ACTIVITY
**Record:** Actively maintained; regular ACPICA syncs in 6.18.y (e.g.,
`e2c80b3c23782`, `6fcab27915439`).

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: DETERMINE WHO IS AFFECTED
**Record:** All systems running ACPI firmware methods — universal on
ACPI platforms. `acpi_evaluate_object` is used across battery, thermal,
power, PCI, processor, and bus code (30+ files under `drivers/acpi/`).

### Step 8.2: DETERMINE THE TRIGGER CONDITIONS
**Record:** ACPI method returns a `RefOf` reference to its own local or
argument without the reference being fully resolved before method
termination. Triggered by specific AML (reproduced with `issue7.aml`;
potentially present in platform firmware). Not a direct unprivileged
syscall path, but firmware-controlled AML runs with kernel privileges.

### Step 8.3: DETERMINE THE FAILURE MODE SEVERITY
**Record:** **HIGH** — heap use-after-free during
`acpi_evaluate_object()`. Can cause kernel oops/crash or memory
corruption. Potential security relevance (UAF in privileged interpreter
context).

### Step 8.4: CALCULATE RISK-BENEFIT RATIO
**Record:**
- **Benefit:** HIGH — prevents real UAF on common ACPI evaluation path
- **Risk:** LOW — 43 lines, single function, teardown-only, maintainer-
  reviewed pattern
- **Ratio:** Strongly favors backport

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: COMPILE THE EVIDENCE

**FOR backport:**
- Confirmed heap UAF with ASAN reproduction (ACPICA #1119)
- Affects `acpi_evaluate_object()` — widely used kernel API
- Buggy code present in 6.18.44 since ~2005
- Small, surgical, obviously correct fix
- ACPI maintainer sign-off
- Precedent: similar ACPICA UAF fixes already in stable series
  (`6fcab27915439`)
- Failure mode is crash/memory corruption, not cosmetic

**AGAINST backport:**
- Requires minor path adjustment for kernel tree (trivial)
- Trigger depends on specific AML patterns (may be rare in the wild, but
  firmware is uncontrolled input)
- No in-kernel Tested-by / Reviewed-by tags in provided message

**UNRESOLVED:**
- Full lore.kernel.org review thread (403)
- Whether this exact commit has landed in mainline kernel yet (not in
  6.18.44)

### Step 9.2: STABLE RULES CHECKLIST
1. Obviously correct and tested? **PASS** — logic is clear; ASAN-tested
   upstream with reproducer; maintainer SOB
2. Fixes a real bug affecting users? **PASS** — confirmed UAF in ACPI
   evaluation
3. Important issue? **PASS** — UAF / potential crash and memory
   corruption (HIGH severity)
4. Small and contained? **PASS** — 43 lines, one function, one file
5. No new features or APIs? **PASS**
6. Can apply to the local tree? **PASS** — code exists; trivial path
   adjustment

### Step 9.3: EXCEPTION CATEGORIES
**Record:** Not applicable (not device ID, quirk, DT, build, or docs).
Standard bug fix.

### Step 9.4: DECISION RATIONALE

This commit fixes a real, reproducible use-after-free in the ACPICA
interpreter teardown path. The vulnerable code is present in Linux
6.18.44, the failure occurs on the `acpi_evaluate_object()` return path
used throughout the kernel, and the fix is minimal with low regression
risk. This is appropriate stable material comparable to the already-
accepted `6fcab27915439` ACPICA UAF fix.

---

## Verification

- [Phase 1] Parsed subject, tags, body; identified UAF fix intent
- [Phase 1] GitHub API: upstream commit `36f22a94cb1b`, author ikaros,
  `Fixes: #1119`
- [Phase 2] Diff: +43 lines in `acpi_ds_terminate_control_method()`,
  REFOF local/arg guard before `acpi_ds_method_data_delete_all()`
- [Phase 3] `git blame -L 717,722`: buggy teardown from 2005-2006
- [Phase 3] `git log --grep`: fix not in tree; related UAF fix
  `6fcab27915439` present
- [Phase 4] GitHub issue #1119: full ASAN report, reproducer `acpiexec
  -m issue7.aml`
- [Phase 4] `b4 dig -c 36f22a94cb1b`: no match (ACPICA-only commit)
- [Phase 4] lore.kernel.org / patch.msgid.link: 403/bot-blocked —
  UNVERIFIED for ML review
- [Phase 5] `grep acpi_ds_terminate_control_method`: callers in
  `psxface.c`, `psparse.c`, `dsmethod.c`
- [Phase 5] Read `nsxfeval.c:472-517`: UAF dereference at `node->object`
  for `ACPI_REFCLASS_REFOF`
- [Phase 5] Read `acstruct.h:66-67`: locals/args embedded in
  `walk_state`
- [Phase 6] `git describe HEAD`: v6.18.44; buggy code confirmed at
  `dsmethod.c:717-721`
- [Phase 6] `grep` for fix comment: not present in tree
- [Phase 6] Upstream patch dry-run: fails on path only; hunk context
  matches kernel file
- [Phase 8] Failure mode: heap UAF → crash/corruption, severity HIGH

**YES**The background searches finished and line up with the earlier
analysis:

- **UAF fix commit search:** No match for “Fix use-after-free in
  acpi_ds_terminate” in this tree — the fix is **not** in 6.18.44 yet.
- **Related fixes search:** Other ACPICA UAF fixes are already here
  (`6fcab27915439` for missing method arguments, `470188b09e92d` for
  package copy), but nothing equivalent for this
  `acpi_ds_terminate_control_method()` issue.

**Verdict for 6.18.44 remains YES** — real, reproducible UAF on the
`acpi_evaluate_object()` path; small, surgical fix; should backport with
the usual ACPICA path adjustment.

 drivers/acpi/acpica/dsmethod.c | 43 ++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 45ec32e81903a..08bfe83030838 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -705,6 +705,8 @@ void
 acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
 				 struct acpi_walk_state *walk_state)
 {
+	u32 i;
+	struct acpi_namespace_node *ref_node;
 
 	ACPI_FUNCTION_TRACE_PTR(ds_terminate_control_method, walk_state);
 
@@ -715,6 +717,47 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
 	}
 
 	if (walk_state) {
+		/*
+		 * Check if the return value is a ref_of reference to a method local
+		 * or argument. If so, clear the reference to avoid use-after-free
+		 * when the walk state is deleted.
+		 */
+		if (walk_state->return_desc &&
+		    (walk_state->return_desc->common.type ==
+		     ACPI_TYPE_LOCAL_REFERENCE)
+		    && (walk_state->return_desc->reference.class ==
+			ACPI_REFCLASS_REFOF)) {
+			ref_node = walk_state->return_desc->reference.object;
+			if (ref_node) {
+
+				/* Check against method locals */
+				for (i = 0; i < ACPI_METHOD_NUM_LOCALS; i++) {
+					if (ref_node ==
+					    &walk_state->local_variables[i]) {
+						acpi_ut_remove_reference
+						    (walk_state->return_desc);
+						walk_state->return_desc = NULL;
+						break;
+					}
+				}
+
+				/* Check against method arguments if not already cleared */
+				if (walk_state->return_desc) {
+					for (i = 0; i < ACPI_METHOD_NUM_ARGS;
+					     i++) {
+						if (ref_node ==
+						    &walk_state->arguments[i]) {
+							acpi_ut_remove_reference
+							    (walk_state->
+							     return_desc);
+							walk_state->
+							    return_desc = NULL;
+							break;
+						}
+					}
+				}
+			}
+		}
 
 		/* Delete all arguments and locals */
 
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: validate byte_count in acpi_ps_get_next_package_length()

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit d49c6ee08365a8596f639da46eb7e71752b0cd42 ]

Validate package length reading in acpi_ps_get_next_package_length().

Link: https://github.com/acpica/acpica/commit/40e03f9941e2
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/3616255.QJadu78ljV@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: ACPICA `acpi_ps_get_next_package_length()`
bounds check

**Local tree:** Linux **6.18.44** (`git describe HEAD` → `v6.18.44`)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject line
**Record:** `[ACPICA] [validate] validate byte_count in
acpi_ps_get_next_package_length()` — ACPI parser subsystem; verb is
“validate,” indicating a safety/bounds fix.

### Step 1.2: Tags
**Record:**
- **Link:** https://github.com/acpica/acpica/commit/40e03f9941e2
  (upstream ACPICA commit)
- **Link:** https://patch.msgid.link/3616255.QJadu78ljV@rafael.j.wysocki
  (kernel submission)
- **Signed-off-by:** ikaros \<void0red@gmail.com\> (author)
- **Signed-off-by:** Rafael J. Wysocki \<rafael.j.wysocki@intel.com\>
  (ACPI maintainer)
- No Fixes:, Reported-by:, Tested-by:, Reviewed-by:, Acked-by:, or Cc:
  stable tags
- Notable: submitted as **[PATCH v1 13/27]** in an ACPICA upstream sync
  series (May 27, 2026)

### Step 1.3: Body analysis
**Record:**
- **Bug:** `acpi_ps_get_next_package_length()` reads package-length
  encoding bytes without checking remaining AML buffer size.
- **Symptom:** Out-of-bounds read when `byte_count` (bits 6:7 of first
  byte) claims more follow-on bytes than exist before `aml_end`.
- **Upstream evidence:** ACPICA issue #1123 documents ASAN heap-buffer-
  overflow at `psargs.c:223` in `AcpiPsGetNextPackageLength`, triggered
  by malformed `issue8.aml` via `acpiexec`.
- **Root cause:** Parser advances and reads `aml[byte_count]` in a loop
  without validating `byte_count + 1 <= remaining`.

### Step 1.4: Hidden bug fix?
**Record:** Yes — despite minimal commit text, this is a confirmed
memory-safety bug fix (heap buffer overflow / OOB read), not cosmetic
cleanup.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory
**Record:**
- **File:** `drivers/acpi/acpica/psargs.c` (+17 lines, 0 removed)
- **Function:** `acpi_ps_get_next_package_length()`
- **Scope:** Single-file, single-function surgical fix

### Step 2.2: Code flow change
**Record:**
- **Hunk 1 (remaining == 0):** Before → reads `aml[0]` unconditionally.
  After → if no bytes remain, return 0 immediately.
- **Hunk 2 (byte_count >= remaining):** Before → reads `aml[0]`,
  advances pointer, loops reading `aml[byte_count]` even past buffer
  end. After → if encoding needs more bytes than available (`byte_count
  >= remaining` means `byte_count + 1 > remaining`), set
  `parser_state->aml = aml_end` and return 0.
- **Normal path:** Unchanged when sufficient bytes exist.

### Step 2.3: Bug mechanism
**Record:**
- **Category:** Buffer overflow / out-of-bounds read (memory safety)
- **Mechanism:** ACPI package-length encoding uses 1–4 bytes. With
  truncated/corrupt AML near `aml_end`, `byte_count` can be 1–3 while
  only 1–2 bytes remain. The `while (byte_count)` loop does
  `aml[byte_count]` past the allocation — exactly matching the ASAN
  report at line 223 (Linux tree line 71: `package_length |=
  (aml[byte_count] << ...)`).

### Step 2.4: Fix quality
**Record:**
- Fix is obviously correct: compares available bytes against encoding
  width before reading.
- Minimal, no unrelated changes.
- Low regression risk: only affects truncated/corrupt AML; valid tables
  unchanged.
- On error, returns 0 and advances to `aml_end` — safe degradation vs.
  OOB read.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:** Core parsing logic dates to **2005** (Bob Moore,
`drivers/acpi/parser/psargs.c`). Bug present since initial
implementation. `aml_end` field and `ACPI_PTR_DIFF` macro already exist
in this tree.

### Step 3.2: Fixes: tag
**Record:** N/A — no Fixes: tag. Upstream ACPICA commit references
GitHub issue #1123.

### Step 3.3: Related file history
**Record:** Recent `psargs.c` changes in 6.18.44 include memory-leak
fixes (`e6169a8ffee8a`, `5accb265f7a1b`) — same file, same maintainer
pattern for stable-worthy ACPICA parser fixes. This specific fix is
**not** yet in the tree.

### Step 3.4: Author context
**Record:** ikaros reported the ACPICA bug with ASAN PoC. Rafael Wysocki
(ACPI maintainer) carried it into kernel as patch 13/27 of an ACPICA
sync.

### Step 3.5: Dependencies
**Record:** Patch is part of a 27-patch series but **this hunk is self-
contained**:
- Uses existing `parser_state->aml_end` (in `struct acpi_parse_state`
  since long ago)
- Uses existing `ACPI_PTR_DIFF` (`include/acpi/actypes.h:505`)
- `git apply --check` succeeds cleanly on 6.18.44
- No prerequisite structural changes from earlier series patches
  required

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original discussion
**Record:**
- **URL:** https://lkml.iu.edu/2605.3/06258.html (patch submission, May
  27, 2026)
- **Series:** v1 13/27 of ACPICA upstream sync
- **Review thread:** No replies visible on lkml.iu.edu mirror; no NAKs
  found
- **Stable nomination:** None found in available thread content

### Step 4.2: Reviewers
**Record:** `b4 dig -c 40e03f9941e2` failed (ACPICA hash, not in Linux
tree). Patch submitted by Rafael Wysocki to linux-acpi; maintainer sign-
off present.

### Step 4.3: Bug report
**Record:**
- **ACPICA issue #1123:** Heap-buffer-overflow, ASAN-confirmed,
  reproducible with `acpiexec -m issue8.aml`
- Stack trace: `AcpiPsGetNextPackageLength` → `AcpiPsGetNextPackageEnd`
  → `AcpiPsGetNextArg` → `AcpiPsParseLoop` → `AcpiNsLoadTable` →
  `AcpiLoadTables`
- Severity: memory safety violation during ACPI table parsing

### Step 4.4: Related patches
**Record:** Same series includes additional boundary checks in
`acpi_ps_peek_opcode()`, `acpi_ps_get_next_field()`,
`acpi_ps_get_next_namestring()` (patches 14–27). Those fix related but
separate OOB paths; this patch stands alone for this specific function.

### Step 4.5: Stable list history
**Record:** lore.kernel.org/stable blocked by bot protection; no stable-
specific discussion found via alternate sources.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key functions
**Record:** `acpi_ps_get_next_package_length()` (modified); callers
include `acpi_ps_get_next_package_end()`.

### Step 5.2: Callers
**Record:**
- `acpi_ps_get_next_package_end()` → used from `acpi_ps_get_next_arg()`
  (ARGP_PKGLENGTH, field parsing)
- `acpi_ps_get_next_package_length()` direct calls in
  `acpi_ps_get_next_field()` (buffer/field length)
- Upstream call chain reaches `acpi_ps_parse_loop()` →
  `acpi_ps_execute_table()` → `acpi_ns_load_table()` →
  `acpi_load_tables()` → `acpi_bus_init()` at boot

### Step 5.3: Callees
**Record:** Uses `ACPI_PTR_DIFF`, pointer arithmetic on
`parser_state->aml` / `aml_end`; no allocations or locks.

### Step 5.4: Reachability
**Record:** **Yes — boot path.** `acpi_bus_init()` calls
`acpi_load_tables()` during ACPI subsystem init. Any corrupt/truncated
DSDT/SSDT AML with malformed package-length encoding can hit this. With
`CONFIG_ACPI_TABLE_OVERRIDE_VIA_BUILTIN_INITRD`, root can supply custom
ACPI tables.

### Step 5.5: Similar patterns
**Record:** Same series adds similar bounds checks elsewhere. Prior
stable-relevant fix in tree: `a3e525feaeec4` “Avoid subobject buffer
overflow when validating RSDP signature.”

---

## PHASE 6: CROSS-REFERENCE WITH LOCAL TREE (6.18.44)

### Step 6.1: Buggy code present?
**Record:** **Yes.** Lines 58–71 of `drivers/acpi/acpica/psargs.c` lack
bounds checking — exactly the vulnerable code. Bug present since ~2005.

### Step 6.2: Backport complications
**Record:** **Clean apply** — `git apply --check` passed with zero
conflicts. `aml_end` and `ACPI_PTR_DIFF` already present.

### Step 6.3: Fix already present?
**Record:** **No.** `git log --grep="validate byte_count"` found
nothing. Current function has no `remaining` variable or bounds checks.

---

## PHASE 7: SUBSYSTEM CONTEXT

### Step 7.1: Subsystem criticality
**Record:** **ACPI / ACPICA parser** — IMPORTANT/CORE for x86/ARM
systems with ACPI. Affects boot-time namespace loading for essentially
all ACPI-enabled machines.

### Step 7.2: Activity
**Record:** Actively maintained; regular ACPICA upstream merges. Recent
`psargs.c` leak fixes confirm ongoing parser hardening.

---

## PHASE 8: IMPACT AND RISK

### Step 8.1: Who is affected
**Record:** All systems using ACPI (most PCs, many ARM servers/laptops).
Config: `CONFIG_ACPI=y` (default on most platforms).

### Step 8.2: Trigger conditions
**Record:**
- Corrupt or truncated ACPI AML in DSDT/SSDT tables
- Malformed package-length encoding near end of AML buffer
- Triggered during boot `acpi_load_tables()` — every boot with bad
  tables
- Root can inject tables via initrd override; firmware/QEMU can supply
  bad tables
- Not directly triggerable by unprivileged userspace, but boot crash is
  severe

### Step 8.3: Failure mode severity
**Record:** **HIGH** — heap-buffer-overflow / OOB read; can cause kernel
oops/panic during early boot, potential info leak with KASAN/ASAN. Boot
failure = system unusable.

### Step 8.4: Risk-benefit
**Record:**
- **Benefit:** HIGH — prevents OOB read on common boot path with corrupt
  ACPI data
- **Risk:** VERY LOW — 17-line bounds check, no API changes, clean apply
- **Ratio:** Strongly favors backport

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence summary

**FOR backport:**
- Confirmed heap-buffer-overflow (ASAN, ACPICA #1123)
- Boot-path ACPI table parsing (`acpi_load_tables`)
- Bug present since 2005 in this tree
- Small, surgical, maintainer-reviewed fix
- Applies cleanly to 6.18.44
- Precedent: similar ACPICA overflow/bounds fixes in stable trees
- Self-contained despite being patch 13/27

**AGAINST backport:**
- Part of larger 27-patch series (but this hunk has no code dependencies
  on siblings)
- No syzbot report (but ASAN PoC exists)
- ACPI tables usually from firmware (limited direct attack surface, but
  corrupt firmware and initrd override are real)

**Unresolved:**
- No visible reviewer stable nominations (lore blocked)
- Full series not yet merged to 6.18.44 (only this patch needed for this
  specific bug)

### Step 9.2: Stable rules checklist
1. Obviously correct and tested? **PASS** — logic is straightforward;
   ASAN-tested upstream
2. Fixes a real bug affecting users? **PASS** — OOB read on ACPI parse
3. Important issue? **PASS** — memory safety, boot-time crash risk
   (HIGH)
4. Small and contained? **PASS** — 17 lines, one function
5. No new features/APIs? **PASS** — defensive bounds check only
6. Can apply to local tree? **PASS** — verified clean apply

### Step 9.3: Exception categories
**Record:** N/A (not device ID, quirk, DT, build fix, or docs — standard
bug fix)

### Step 9.4: Decision rationale
For **Linux 6.18.44**, the vulnerable code exists, the fix applies
cleanly, and the bug is a confirmed out-of-bounds read on the ACPI boot
parsing path. This meets all stable kernel criteria.

---

## Verification

- [Phase 1] Parsed subject, tags, body; identified ASAN-confirmed OOB
  read
- [Phase 1] Fetched ACPICA commit 40e03f9941e2 and issue #1123 from
  GitHub
- [Phase 2] Read current `psargs.c:45-80` — vulnerable code confirmed
- [Phase 2] Analyzed diff: adds `remaining` check before `byte_count`
  read loop
- [Phase 3] `git blame`: buggy logic from 2005; fix not present
- [Phase 3] `git log --oneline -20 -- drivers/acpi/acpica/psargs.c`: no
  matching fix
- [Phase 3] Verified `struct acpi_parse_state.aml_end` in
  `aclocal.h:912`
- [Phase 3] Verified `ACPI_PTR_DIFF` in `include/acpi/actypes.h:505`
- [Phase 4] `b4 dig -c 40e03f9941e2`: no match (ACPICA-only hash)
- [Phase 4] lkml.iu.edu/2605.3/06258.html: patch 13/27, Rafael Wysocki
  submission
- [Phase 4] GitHub issue #1123: ASAN stack trace and reproduction steps
- [Phase 5] Traced callers: `acpi_ps_get_next_package_end` →
  `acpi_ps_get_next_arg` → parse loop → `acpi_ns_load_table` →
  `acpi_load_tables` → `acpi_bus_init`
- [Phase 5] Confirmed `acpi_load_tables()` call in
  `drivers/acpi/bus.c:1413`
- [Phase 6] `git describe HEAD`: v6.18.44
- [Phase 6] `git apply --check`: patch applies cleanly
- [Phase 6] Confirmed fix absent (`remaining` variable not in current
  code)
- [Phase 8] Assessed severity: HIGH (boot-time OOB read)
- [UNVERIFIED] Full lore review thread replies (lore blocked by Anubis)
- [UNVERIFIED] Whether entire 27-patch series will merge before next
  6.18.y release (does not affect standalone merit of this fix)

**YES****Verdict: YES** — backport to this tree (Linux 6.18.44).

The commit adds bounds checks in `acpi_ps_get_next_package_length()` so
truncated or corrupt ACPI AML cannot trigger an out-of-bounds read when
decoding package-length fields. That bug is confirmed upstream (ASAN
heap-buffer-overflow, ACPICA issue #1123), hits the boot path via
`acpi_load_tables()`, and the vulnerable code is still present in
6.18.44. The patch is small (17 lines), self-contained, and applies
cleanly.

 drivers/acpi/acpica/psargs.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 55273cbbfc67e..3526ea1094146 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -48,6 +48,7 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state)
 	u32 package_length = 0;
 	u32 byte_count;
 	u8 byte_zero_mask = 0x3F;	/* Default [0:5] */
+	u32 remaining;
 
 	ACPI_FUNCTION_TRACE(ps_get_next_package_length);
 
@@ -55,7 +56,23 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state)
 	 * Byte 0 bits [6:7] contain the number of additional bytes
 	 * used to encode the package length, either 0,1,2, or 3
 	 */
+
+	/* Check if we have at least one byte to read */
+	remaining = (u32)ACPI_PTR_DIFF(parser_state->aml_end, aml);
+	if (remaining == 0) {
+		return_UINT32(0);
+	}
+
 	byte_count = (aml[0] >> 6);
+
+	/* Validate byte_count and ensure we have enough bytes to read */
+	if (byte_count >= remaining) {
+
+		/* Clamp to available bytes and advance to end */
+		parser_state->aml = parser_state->aml_end;
+		return_UINT32(0);
+	}
+
 	parser_state->aml += ((acpi_size)byte_count + 1);
 
 	/* Get bytes 3, 2, 1 as needed */
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.15] ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach

[Sasha Levin]

From: Chen Pei <cp0613@linux.alibaba.com>

[ Upstream commit 3a59c3b772e5dc0cedecce8e7fbf7c2d6245b643 ]

PCI root bridges enumerated by acpi_pci_root_add() can be the _DEP
supplier for other ACPI consumers, most notably ACPI0017 CXL root
devices whose probe path depends on acpi_pci_find_root() succeeding.
Once the root bus has been added, those consumers can safely be
enumerated, so notify them by clearing the dependency.

Call acpi_dev_clear_dependencies() at the end of acpi_pci_root_add(),
after pci_bus_add_devices(), following the same pattern used by other
ACPI suppliers such as the EC (drivers/acpi/ec.c) and the ACPI PCI
Link device (drivers/acpi/pci_link.c). The clear is intentionally
done only on the success path; on the error paths the supplier did
not attach and consumers must keep dep_unmet set.

This is a prerequisite for honoring _DEP on ACPI0016 host bridges,
which matters on architectures where the probe order of acpi_pci_root
relative to cxl_acpi is not guaranteed (e.g. RISC-V).

Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Suggested-by: Dan Williams (nvidia) <djbw@kernel.org>
Tested-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260526025118.38935-2-cp0613@linux.alibaba.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

The background searches finished and match the earlier analysis:

- **Commit located**: `b52e0117014b6` (stable prep) and upstream
  `3a59c3b772e5d` — on `autosel` / `all-next`, not in current `v6.18.44`
  HEAD.
- **Companion patch**: `82dbacca5220e` (“Honor _DEP for ACPI0016”) is
  also only on `autosel`, not in 6.18.44.
- **Current tree**: `drivers/acpi/pci_root.c` still lacks
  `acpi_dev_clear_dependencies()`, and `acpi_honor_dep_ids[]` has no
  `ACPI0016` entry.

**Verdict unchanged: YES** — backport this commit together with patch
2/2 for the CXL `_DEP` ordering fix on 6.18.y.

 drivers/acpi/pci_root.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 74ade41603145..332568e00f37c 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -760,6 +760,10 @@ static int acpi_pci_root_add(struct acpi_device *device,
 	pci_lock_rescan_remove();
 	pci_bus_add_devices(root->bus);
 	pci_unlock_rescan_remove();
+
+	/* Clear _DEP dependencies to allow consumers to enumerate */
+	acpi_dev_clear_dependencies(device);
+
 	return 1;
 
 remove_dmar:
-- 
2.53.0

[PATCH AUTOSEL 6.18-6.1] ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit 485829e6999b7909f50761a1c708660304edc945 ]

Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() to
prevent buffer overflows.

Link: https://github.com/acpica/acpica/commit/f85a43098d65
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2230782.OBFZWjSADL@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: ACPICA OEM ID/Table ID Validation in
`acpi_ex_load_table_op()`

**Local tree:** `v6.18.44` (Linux 6.18.y stable)
**Mainline commit:** `485829e6999b7` (not yet in this tree)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject Line
**Record:** `[ACPICA] [enhance/validate] Enhance OEM ID and Table ID
validation in acpi_ex_load_table_op() to prevent buffer overflows`

### Step 1.2: Tags
**Record:**
- **Link:** https://github.com/acpica/acpica/commit/f85a43098d65
  (upstream ACPICA fix)
- **Link:** https://patch.msgid.link/2230782.OBFZWjSADL@rafael.j.wysocki
  (kernel submission)
- **Signed-off-by:** ikaros \<void0red@gmail.com\> (author)
- **Signed-off-by:** Rafael J. Wysocki \<rafael.j.wysocki@intel.com\>
  (ACPI maintainer)
- No `Fixes:`, `Reported-by:`, `Cc: stable@vger.kernel.org`, `Tested-
  by:`, or `Reviewed-by:` tags
- Notable: maintainer merge; part of ACPICA 20260408 import series
  (patch 22/27)

### Step 1.3: Body Analysis
**Record:**
- **Bug:** `acpi_ex_load_table_op()` passes AML string operand pointers
  directly to `acpi_tb_find_table()`, which reads fixed
  `ACPI_OEM_ID_SIZE` (6) and `ACPI_OEM_TABLE_ID_SIZE` (8) bytes via
  `memcpy()` regardless of actual string length.
- **Symptom:** Heap-buffer-overflow on read when OEM ID/Table ID strings
  are shorter than those fixed sizes.
- **Root cause:** AML strings have explicit `.length` fields;
  allocations are `length + 1` bytes. `acpi_tb_find_table()` always
  copies 6/8 bytes from the pointer.
- **Version info:** None in commit message; bug mechanism dates to
  original `acpi_ex_load_table_op()` code (2005).

### Step 1.4: Hidden Bug Fix Detection
**Record:** Yes — despite "Enhance validation" wording, this is a real
memory-safety bug fix. Upstream ACPICA issue
[#1144](https://github.com/acpica/acpica/issues/1144) documents an ASAN
heap-buffer-overflow with reproducer (`issue49.aml`).

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Change Inventory
**Record:**
- **File:** `drivers/acpi/acpica/exconfig.c` (+24 / -2)
- **Function:** `acpi_ex_load_table_op()`
- **Scope:** Single-file, surgical fix

### Step 2.2: Code Flow Change
**Record:**
- **Hunk 1 (stack buffers):** Adds `oem_id[7]` and `oem_table_id[9]`
  local buffers.
- **Hunk 2 (validation):** Before calling `acpi_tb_find_table()`, checks
  `operand[1]->string.length <= ACPI_OEM_ID_SIZE` and
  `operand[2]->string.length <= ACPI_OEM_TABLE_ID_SIZE`; returns
  `AE_AML_STRING_LIMIT` on violation.
- **Hunk 3 (safe copy):** Copies only `operand[n]->string.length` bytes
  into local buffers, null-terminates, passes local buffers to
  `acpi_tb_find_table()` instead of raw AML pointers.
- **Before:** Raw AML pointers passed → `acpi_tb_find_table()` does
  `memcpy(..., ACPI_OEM_ID_SIZE)` (6 bytes) from potentially 1–2 byte
  allocation.
- **After:** Length-validated, null-terminated stack buffers of exactly
  the right size are passed.

### Step 2.3: Bug Mechanism
**Record:**
- **Category:** Buffer over-read / heap-buffer-overflow (memory safety)
- **Mechanism:** In `acpi_tb_find_table()` at lines 60–61 of `tbfind.c`:

```60:61:drivers/acpi/acpica/tbfind.c
        memcpy(header.oem_id, oem_id, ACPI_OEM_ID_SIZE);
        memcpy(header.oem_table_id, oem_table_id,
ACPI_OEM_TABLE_ID_SIZE);
```

  `strlen()` validation (lines 51–53) only checks upper bound; it does
not prevent reading past a short string's allocation. A 1-byte OEM ID
gets a 2-byte allocation (`string_size + 1` in
`acpi_ut_create_string_object()`), but `memcpy` reads 6 bytes.

### Step 2.4: Fix Quality
**Record:**
- Fix is obviously correct and minimal.
- Uses known AML `.length` rather than `strlen()` on potentially
  non–null-terminated data.
- Stack buffers are correctly sized (`ACPI_OEM_ID_SIZE + 1`,
  `ACPI_OEM_TABLE_ID_SIZE + 1`).
- **Regression risk:** Very low. Only affects the `LoadTable` AML opcode
  path; oversized strings now correctly return `AE_AML_STRING_LIMIT`
  instead of proceeding to over-read.
- Error-path cleanup is handled by `exoparg6.c` cleanup on
  `ACPI_FAILURE(status)`.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:**
- Vulnerable `acpi_tb_find_table(operand[0]..., operand[1]...,
  operand[2]...)` call introduced in commit `4be44fcd3bf648` (Len Brown,
  2005-08-05).
- Bug present in this tree since kernel import of ACPICA.

### Step 3.2: Fixes Tag
**Record:** N/A — no `Fixes:` tag in commit message.

### Step 3.3: Related File History
**Record:**
- Commit `9f41fd8a175ff` (2015, "Update parameter validation for
  data_table_region and load_table") **removed** length validation from
  `acpi_ex_load_table_op()` and relied on `acpi_tb_find_table()`'s
  `strlen()` checks — which do not prevent the short-string `memcpy`
  over-read.
- Fix is **not** in 6.18.y (`git log --grep="Enhance OEM"` returns
  nothing on this branch).
- Fix **is** on mainline: `485829e6999b7` (merged May 27, 2026).

### Step 3.4: Author Context
**Record:** ikaros (void0red) reported ACPICA issue #1144 and
contributed 14 patches in the ACPICA 20260408 series. Rafael J. Wysocki
merged to mainline.

### Step 3.5: Dependencies
**Record:** Patch is labeled 22/27 in the ACPICA import series but is
**standalone** — it only touches `acpi_ex_load_table_op()` and has no
structural dependencies on other series patches. `git cherry-pick --no-
commit 485829e6999b7` applies cleanly to v6.18.44.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original Discussion
**Record:**
- **b4 dig URL:**
  https://patch.msgid.link/2230782.OBFZWjSADL@rafael.j.wysocki
- **Series:** v1 only (ACPICA 20260408, 27 patches); no v2/v3 revisions
  for this patch.
- **Review feedback:** No NAKs or stable nominations found in saved
  thread mbox.
- Maintainer cover letter confirms routine ACPICA upstream sync.

### Step 4.2: Reviewers
**Record:** CC'd: Rafael J. Wysocki, linux-acpi@vger.kernel.org, LKML,
Saket Dumbre (Intel), Pawel Chmielewski (Intel).

### Step 4.3: Bug Report
**Record:**
- **ACPICA issue #1144:** Heap-buffer-overflow in `AcpiTbFindTable` via
  `LOAD_TABLE_OP`.
- **ASAN:** READ of size 6, 0 bytes past end of 49-byte region;
  reproducer `issue49.aml` via `acpiexec`.
- **Call chain:** `AcpiExLoadTableOp` → `AcpiTbFindTable` →
  `AcpiPsParseAml` → `AcpiNsLoadTable` → `AcpiLoadTables`.

### Step 4.4: Related Patches
**Record:** Same author has 13 other fixes in the series (integer
overflows, NULL checks, etc.). This patch is independent. Note:
`acpi_ds_eval_table_region_operands()` in `dsopcode.c` still passes raw
pointers to `acpi_tb_find_table()` — a separate, unfixed path not
addressed by this commit.

### Step 4.5: Stable List History
**Record:** No stable-list discussion found for this specific fix. (Lore
stable search blocked by bot protection; b4 mbox had no stable
mentions.)

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key Functions
**Record:** `acpi_ex_load_table_op()` (modified), `acpi_tb_find_table()`
(caller of fixed behavior).

### Step 5.2: Callers
**Record:**
- `exoparg6.c:272` — `case AML_LOAD_TABLE_OP: status =
  acpi_ex_load_table_op(...)`
- Invoked during AML interpretation when `LoadTable()` opcode executes.

### Step 5.3: Callees
**Record:** `acpi_ut_create_integer_object()`, `acpi_tb_find_table()`,
`acpi_ex_add_table()`, namespace/scope operations.

### Step 5.4: Reachability
**Record:**
- **Boot:** ACPI table loading/parsing (`acpi_load_tables()` → namespace
  load → AML parse).
- **Runtime:** `acpi_load_table()` API (e.g., `acpi_configfs.c` for
  root-loaded SSDTs).
- **Trigger:** Malformed/crafted ACPI AML containing `LoadTable()` with
  undersized OEM ID/Table ID string operands.
- **Userspace reachability:** Root can inject ACPI tables via configfs;
  firmware-supplied tables are the common case. Not directly triggerable
  by unprivileged users, but boot-time parsing of malicious firmware
  tables is a realistic attack surface.

### Step 5.5: Similar Patterns
**Record:** `dsopcode.c:507-509` (`acpi_ds_eval_table_region_operands`)
has the same raw-pointer pattern — unfixed by this commit. The 2015 BZ
1184 fix targeted `data_table_region` error handling but did not fix the
`LoadTable` opcode path addressed here.

---

## PHASE 6: CROSS-REFERENCE AGAINST LOCAL TREE

### Step 6.1: Buggy Code Present?
**Record:** **Yes.** Current `exconfig.c` lines 108–110 pass raw operand
pointers:

```108:110:drivers/acpi/acpica/exconfig.c
        status = acpi_tb_find_table(operand[0]->string.pointer,
                                    operand[1]->string.pointer,
                                    operand[2]->string.pointer,
&table_index);
```

### Step 6.2: Backport Complications
**Record:** **Clean apply.** Cherry-pick tested successfully on
v6.18.44. No conflicts expected.

### Step 6.3: Related Fixes Already Present?
**Record:** **No.** `git log --grep="Enhance OEM"` on this branch
returns nothing. Mainline has `485829e6999b7`; 6.18.y does not.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: Subsystem Criticality
**Record:** **ACPI / ACPICA interpreter** — IMPORTANT. ACPI is on every
ACPI-enabled system; interpreter bugs affect boot and runtime ACPI
method execution.

### Step 7.2: Subsystem Activity
**Record:** Actively maintained; periodic ACPICA upstream syncs. Recent
6.18.y history is mostly copyright updates, not functional changes to
this path.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who Is Affected
**Record:** All systems with `CONFIG_ACPI` on ACPI firmware or
dynamically loaded ACPI tables that execute `LoadTable()` AML with short
OEM strings.

### Step 8.2: Trigger Conditions
**Record:**
- **When:** ACPI AML interpretation executing `LoadTable(Sig, OEMID,
  OEMTableID, ...)`.
- **Condition:** OEM ID string operand length < 6 bytes, or OEM Table ID
  < 8 bytes.
- **Likelihood:** Uncommon in legitimate firmware (OEM fields are
  typically padded to full size), but trivially reproducible with
  crafted AML (confirmed by upstream reproducer).
- **Privilege:** Root for dynamic table load; boot-time for firmware
  tables.

### Step 8.3: Failure Mode Severity
**Record:** Heap-buffer-overflow (read past allocation) → **HIGH**
severity. Can cause kernel oops/crash; potential info leak or further
memory corruption depending on heap layout. ASAN-confirmed.

### Step 8.4: Risk-Benefit
**Record:**
- **Benefit:** HIGH — closes a confirmed memory-safety hole in ACPI
  interpreter.
- **Risk:** VERY LOW — 22 lines, single function, no API changes.
- **Ratio:** Strongly favors backport.

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence Summary

**FOR backport:**
- Confirmed heap-buffer-overflow with ASAN reproducer (ACPICA #1144)
- Bug exists in v6.18.44 tree (verified in source)
- Small, surgical, obviously correct fix
- Applies cleanly to 6.18.y
- Maintainer-merged on mainline
- Memory-safety issue in core ACPI interpreter path
- Self-contained (no series dependencies)

**AGAINST backport:**
- Trigger requires crafted/short OEM strings in `LoadTable` AML — rare
  in legitimate firmware
- Not directly exploitable by unprivileged users (requires root or
  malicious firmware)
- `dsopcode.c` data-table-region path has similar unfixed pattern (out
  of scope)

**Unresolved:**
- No explicit `Cc: stable` or reviewer stable nomination found
- Full lore thread review limited to b4-saved mbox (no replies captured)

### Step 9.2: Stable Rules Checklist
1. Obviously correct and tested? **PASS** — ASAN reproducer upstream;
   logic is straightforward.
2. Fixes a real bug affecting users? **PASS** — confirmed heap-buffer-
   overflow.
3. Important issue? **PASS** — memory-safety / potential crash (HIGH).
4. Small and contained? **PASS** — 1 file, ~22 lines.
5. No new features or APIs? **PASS** — validation/copy only.
6. Can apply to local tree? **PASS** — cherry-pick applies cleanly to
   v6.18.44.

### Step 9.3: Exception Categories
**Record:** N/A (not a device ID, quirk, DT, build, or docs fix —
standard bug fix).

### Step 9.4: Decision Rationale

This commit fixes a real, ASAN-confirmed heap-buffer-overflow in the
ACPI `LoadTable` opcode handler. The vulnerable code is present in Linux
6.18.y and has been since the function was introduced.
`acpi_tb_find_table()` unconditionally reads 6/8 bytes from OEM string
pointers, but AML string objects may be allocated with fewer bytes. The
fix validates lengths using the AML `.length` field and copies into
properly sized, null-terminated stack buffers before calling
`acpi_tb_find_table()`.

For 6.18.y stable users, this is exactly the kind of memory-safety fix
that belongs in -stable: small, contained, obviously correct, and
preventing a confirmed kernel memory corruption path during ACPI table
operations.

---

## Verification

- [Phase 1] Parsed subject, tags, body; identified buffer overflow fix
  intent
- [Phase 1] GitHub ACPICA issue #1144: ASAN heap-buffer-overflow,
  reproducer confirmed
- [Phase 2] Read diff: +24/-2 in `exconfig.c`, adds validation + safe
  copy
- [Phase 2] Read `tbfind.c:51-61`: `strlen` upper-bound check + fixed-
  size `memcpy` confirms over-read mechanism
- [Phase 2] Read `utobject.c:256-274`: string allocation is `string_size
  + 1` bytes
- [Phase 3] `git describe HEAD`: v6.18.44 (6.18.y stable)
- [Phase 3] `git blame exconfig.c:108-110`: vulnerable call since 2005
  (4be44fcd3bf648)
- [Phase 3] `git show 9f41fd8a175ff`: 2015 commit removed length
  validation from `acpi_ex_load_table_op`, did not fix short-string
  over-read
- [Phase 3] `git log --grep="Enhance OEM"` on 6.18.y: no results (fix
  absent)
- [Phase 3] `git show 485829e6999b7`: mainline commit confirmed
- [Phase 3] `git cherry-pick --no-commit 485829e6999b7`: applies cleanly
  (exit 0)
- [Phase 4] `b4 dig -c 485829e6999b7`: lore URL found
- [Phase 4] `b4 dig -a`: v1 series only, patch 22/27
- [Phase 4] `b4 dig -w`: Rafael Wysocki, linux-acpi, Intel developers
  CC'd
- [Phase 4] `b4 dig -m /tmp/acpica_thread.mbox`: thread saved; no
  stable/NAK mentions
- [Phase 5] `grep acpi_ex_load_table_op`: caller in `exoparg6.c:272`
  (`AML_LOAD_TABLE_OP`)
- [Phase 5] `grep acpi_load_table`: reachable via `acpi_configfs.c`,
  `bus.c`
- [Phase 6] Read current `exconfig.c:108-110`: buggy code confirmed
  present
- [Phase 6] Cherry-pick test: clean apply to v6.18.44
- [Phase 8] Failure mode: heap-buffer-overflow, severity HIGH

**YES**The background searches finished and match the earlier analysis:

- **Fix search:** No “Enhance OEM ID” commit on **6.18.y** — the fix is
  only on mainline (`485829e6999b7`).
- **Author search:** **ikaros** has other kernel commits here, but not
  this ACPI validation patch.

**Verdict for 6.18.y:** **YES** — backport the heap-buffer-overflow fix
in `acpi_ex_load_table_op()`; it applies cleanly.

 drivers/acpi/acpica/exconfig.c | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/acpica/exconfig.c b/drivers/acpi/acpica/exconfig.c
index 4d7dd0fc6b07b..894695db0cf94 100644
--- a/drivers/acpi/acpica/exconfig.c
+++ b/drivers/acpi/acpica/exconfig.c
@@ -90,6 +90,8 @@ acpi_ex_load_table_op(struct acpi_walk_state *walk_state,
 	union acpi_operand_object *return_obj;
 	union acpi_operand_object *ddb_handle;
 	u32 table_index;
+	char oem_id[ACPI_OEM_ID_SIZE + 1];
+	char oem_table_id[ACPI_OEM_TABLE_ID_SIZE + 1];
 
 	ACPI_FUNCTION_TRACE(ex_load_table_op);
 
@@ -102,12 +104,32 @@ acpi_ex_load_table_op(struct acpi_walk_state *walk_state,
 
 	*return_desc = return_obj;
 
+	/*
+	 * Validate OEM ID and OEM Table ID string lengths.
+	 * acpi_tb_find_table expects strings that can safely read
+	 * ACPI_OEM_ID_SIZE and ACPI_OEM_TABLE_ID_SIZE bytes.
+	 */
+	if ((operand[1]->string.length > ACPI_OEM_ID_SIZE) ||
+	    (operand[2]->string.length > ACPI_OEM_TABLE_ID_SIZE)) {
+		return_ACPI_STATUS(AE_AML_STRING_LIMIT);
+	}
+
+	/*
+	 * Copy OEM strings to local buffers with guaranteed null-termination.
+	 * This prevents heap-buffer-overflow when acpi_tb_find_table reads
+	 * ACPI_OEM_ID_SIZE/ACPI_OEM_TABLE_ID_SIZE bytes.
+	 */
+	memcpy(oem_id, operand[1]->string.pointer, operand[1]->string.length);
+	oem_id[operand[1]->string.length] = 0;
+	memcpy(oem_table_id, operand[2]->string.pointer,
+	       operand[2]->string.length);
+	oem_table_id[operand[2]->string.length] = 0;
+
 	/* Find the ACPI table in the RSDT/XSDT */
 
 	acpi_ex_exit_interpreter();
 	status = acpi_tb_find_table(operand[0]->string.pointer,
-				    operand[1]->string.pointer,
-				    operand[2]->string.pointer, &table_index);
+				    oem_id, oem_table_id, &table_index);
 	acpi_ex_enter_interpreter();
 	if (ACPI_FAILURE(status)) {
 		if (status != AE_NOT_FOUND) {
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: Add validation for node in acpi_ns_build_normalized_path()

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit 96b2b616870e46e2bc04efec03879683a0036e66 ]

Add validation for node in acpi_ns_build_normalized_path()
to prevent use-after-free vulnerabilities.

Link: https://github.com/acpica/acpica/commit/b35adf49e89a
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/118666237.nniJfEyVGO@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

## Phase 1: Commit Message Forensics

**Step 1.1 — Subject line**
Record: `[ACPICA] [Add] validation for node in
acpi_ns_build_normalized_path() to prevent use-after-free`

**Step 1.2 — Tags**
Record:
- Link: https://github.com/acpica/acpica/commit/b35adf49e89a
- Link: https://patch.msgid.link/118666237.nniJfEyVGO@rafael.j.wysocki
- Signed-off-by: ikaros \<void0red@gmail.com\>
- Signed-off-by: Rafael J. Wysocki \<rafael.j.wysocki@intel.com\>
- No Fixes:, Reported-by:, Tested-by:, Reviewed-by:, or Cc: stable tags
- Notable: ACPICA maintainer (Rafael J. Wysocki) signed off; upstream
  ACPICA commit link present

**Step 1.3 — Body analysis**
Record:
- Bug: `acpi_ns_build_normalized_path()` can dereference an
  invalid/freed namespace node pointer
- Symptom: heap use-after-free when reading `next_node->name`
- Root cause (from upstream issue #1138): during ACPI AML
  parsing/cleanup, walk state is freed while a stale `method_node` is
  still passed into pathname building via `acpi_ex_stop_trace_method()`
  → `acpi_ns_get_normalized_pathname()` →
  `acpi_ns_build_normalized_path()`
- No kernel version range stated in commit message

**Step 1.4 — Hidden bug fix?**
Record: No — explicitly described as UAF prevention, not disguised
cleanup.

---

## Phase 2: Diff Analysis

**Step 2.1 — Inventory**
Record:
- `drivers/acpi/acpica/nsnames.c`: +6 lines, 0 removed
- Function modified: `acpi_ns_build_normalized_path()`
- Scope: single-file, surgical fix

**Step 2.2 — Code flow change**
Record:
- Before: after NULL check on `node`, function immediately walks
  `next_node->parent` chain and reads `next_node->name` via
  `ACPI_MOVE_32_TO_32`
- After: if `ACPI_GET_DESCRIPTOR_TYPE(node) != ACPI_DESC_TYPE_NAMED`,
  jump to `build_trailing_null` (return empty path with trailing NUL)
  instead of dereferencing
- Affected path: any caller passing a stale/invalid node into
  `acpi_ns_build_normalized_path()`

**Step 2.3 — Bug mechanism**
Record:
- Category: **memory safety / use-after-free**
- Mechanism: freed walk-state memory is still referenced as a namespace
  node; reading `next_node->name` at the line equivalent to current line
  232 triggers ASAN heap-use-after-free (confirmed upstream in ACPICA
  issue #1138)

**Step 2.4 — Fix quality**
Record:
- Obviously correct: matches existing ACPICA validation pattern used in
  `acpi_ns_get_pathname_length()` (lines 56–63 of the same file),
  `acpi_ns_validate_handle()`, and `acpi_ut_get_node_name()`
- Minimal, no unrelated changes
- Regression risk: very low — invalid nodes get empty path instead of
  crash; valid nodes unchanged

---

## Phase 3: Git History Investigation

**Step 3.1 — Blame**
Record: vulnerable loop introduced in `d1e7ffe50ba58` (2015, "ACPICA:
Namespace: Add function to directly return normalized full path"). Bug
has been present since that function was added.

**Step 3.2 — Fixes: tag**
Record: N/A — no Fixes: tag in commit message.

**Step 3.3 — File history**
Record: `nsnames.c` is long-stable ACPI code; recent changes are
formatting/copyright, not structural refactors. Fix is standalone (not
dependent on other patches in the 27-patch ACPICA series).

**Step 3.4 — Author**
Record: ikaros (void0red) reported the UAF to upstream ACPICA; Rafael J.
Wysocki (ACPI maintainer) committed to Linux.

**Step 3.5 — Dependencies**
Record: no prerequisites. Patch 12/27 in the same series fixes a related
UAF in `acpi_ds_terminate_control_method()`, but this validation patch
is independent and self-contained. `git apply --check` confirms clean
apply to this tree.

---

## Phase 4: Mailing List and External Research

**Step 4.1 — Original discussion**
Record:
- b4 dig found: [PATCH v1 19/27] at
  https://patch.msgid.link/118666237.nniJfEyVGO@rafael.j.wysocki
- Part of "ACPI: ACPICA 20260408" series (27 patches)
- v1 only revision found
- No NAKs or stable nominations found in thread mbox

**Step 4.2 — Reviewers**
Record: CC'd to Rafael J. Wysocki, linux-acpi, LKML, Saket Dumbre, Pawel
Chmielewski (Intel ACPICA developers).

**Step 4.3 — Bug report**
Record: ACPICA GitHub issue #1138 documents:
- ASAN heap-use-after-free at `AcpiNsBuildNormalizedPath` reading 4
  bytes (`next_node->name`)
- Reproducer: `./generate/unix/bin/acpiexec -m issue33.aml`
- Call chain: `acpi_ns_build_normalized_path` ←
  `acpi_ns_get_normalized_pathname` ← `acpi_ex_stop_trace_method` ←
  `acpi_ds_terminate_control_method` ← AML parse/table load path
- Severity: confirmed memory safety bug with concrete reproducer

**Step 4.4 — Related patches**
Record: patch 12/27 addresses a different UAF root cause in
`acpi_ds_terminate_control_method()`. Patch 19/27 (this commit) is a
defensive guard at the common pathname builder. Both are security-
relevant; this one stands alone.

**Step 4.5 — Stable list**
Record: no Cc: stable discussion found in downloaded thread.

---

## Phase 5: Code Semantic Analysis

**Step 5.1 — Key functions**
Record: `acpi_ns_build_normalized_path()` (modified); callers include
`acpi_ns_get_pathname_length()`, `acpi_ns_handle_to_pathname()`,
`acpi_ns_get_normalized_pathname()`

**Step 5.2 — Callers**
Record: `acpi_ns_get_normalized_pathname()` is called from many ACPI
paths including:
- `acpi_ex_stop_trace_method()` in `extrace.c` (UAF trigger path)
- `acpi_ns_get_external_pathname()`, `nsparse.c`, `nsinit.c`,
  `dsmethod.c`, `nseval.c`, `nssearch.c`
- Debugger-only paths (`db*.c`) — less relevant for production

**Step 5.3 — Callees**
Record: reads node descriptor type, walks parent chain, copies 4-byte
ACPI names; no allocation in the vulnerable section.

**Step 5.4 — Reachability**
Record:
- Call chain reaches ACPI table loading and method termination during
  normal kernel ACPI operation (boot + runtime method execution)
- Trigger requires crafted/malformed ACPI AML that causes walk-state
  teardown with stale node reference — demonstrated with `issue33.aml`
  in acpiexec; same ACPICA code runs in the kernel

**Step 5.5 — Similar patterns**
Record: `acpi_ns_get_pathname_length()` already validates descriptor
type before calling `acpi_ns_build_normalized_path()`, but
`acpi_ns_get_normalized_pathname()` does not — creating the gap this
patch closes at the lowest common level.

---

## Phase 6: Cross-Reference Against Local Tree

**Step 6.1 — Buggy code in tree?**
Record: **YES**. Local tree is **Linux 6.18.44** (`git describe HEAD` →
`v6.18.44`). Vulnerable code is present at lines 221–244 of
`drivers/acpi/acpica/nsnames.c` without the descriptor-type check. Fix
commit `96b2b616870e4` is **not** an ancestor of HEAD.

**Step 6.2 — Backport complications**
Record: clean apply confirmed (`git apply --check` → CLEAN APPLY). No
rework needed.

**Step 6.3 — Related fixes already present?**
Record: no — `git log -S "Validate the Node to avoid use-after-free"`
finds nothing in this tree; related patch 12/27
(`acpi_ds_terminate_control_method` UAF fix) also absent.

---

## Phase 7: Subsystem and Maintainer Context

**Step 7.1 — Subsystem criticality**
Record: **ACPI/ACPICA** — IMPORTANT to CORE. ACPI is on every x86/ARM
server, laptop, and most embedded systems with firmware tables.

**Step 7.2 — Activity**
Record: ACPI subsystem actively maintained in this tree (recent NULL-
deref and execution-abort fixes in `drivers/acpi/acpica/`).

---

## Phase 8: Impact and Risk Assessment

**Step 8.1 — Who is affected**
Record: all systems using in-kernel ACPICA for ACPI table parsing and
AML method execution.

**Step 8.2 — Trigger conditions**
Record: malformed/crafted ACPI AML during table load or method
termination with tracing enabled path; demonstrated with acpiexec +
crafted AML. Requires specific ACPI content, but ACPI tables are
firmware-supplied and occasionally attacker-influenced (e.g., custom
DSDT injection in some environments).

**Step 8.3 — Failure mode severity**
Record: **heap use-after-free** → kernel oops/panic or potential
information disclosure/exploitation primitive. Severity: **HIGH**.

**Step 8.4 — Risk-benefit**
Record:
- Benefit: **HIGH** — prevents real UAF on ACPI parsing path
- Risk: **VERY LOW** — 6-line defensive check, established ACPICA
  pattern
- Ratio: strongly favors backport

---

## Phase 9: Final Synthesis

**Step 9.1 — Evidence summary**

FOR backport:
- Confirmed heap UAF with ASAN report and reproducer (ACPICA #1138)
- Affects ACPI table/method execution — common kernel path
- Small, surgical, obviously correct fix
- Matches existing validation patterns in same subsystem
- Applies cleanly to Linux 6.18.44
- Signed off by ACPI maintainer
- Bug present since 2015 — long exposure window

AGAINST backport:
- Part of larger ACPICA import series (but this patch is standalone)
- No explicit stable nomination in mailing list
- Related root-cause fix exists separately in patch 12/27 (but this
  defensive fix has independent value)

UNRESOLVED: none material to the decision.

**Step 9.2 — Stable rules checklist**
1. Obviously correct and tested? **PASS** — ASAN-verified bug, standard
   ACPICA validation pattern
2. Fixes a real bug? **PASS** — confirmed heap UAF
3. Important issue? **PASS** — memory safety during ACPI parsing
   (crash/security)
4. Small and contained? **PASS** — 6 lines, one function
5. No new features/APIs? **PASS** — defensive validation only
6. Can apply to local tree? **PASS** — clean apply verified

**Step 9.3 — Exception category**
Record: N/A (security/memory-safety bug fix, not a quirk/ID/DT
exception).

**Step 9.4 — Decision rationale**

For **Linux 6.18.44**, this commit should be backported. The vulnerable
`acpi_ns_build_normalized_path()` code exists in this tree, the fix is
absent, and upstream has demonstrated a reproducible heap use-after-free
on the ACPI AML parsing/teardown path that the kernel shares. The fix is
minimal, follows established ACPICA conventions already used in sibling
functions in the same file, and prevents dereferencing freed namespace
nodes by validating the descriptor type before walking the parent chain.

---

## Verification

- [Phase 1] Parsed commit message and tags from `git show 96b2b616870e4`
- [Phase 1] Fetched ACPICA upstream issue #1138 — ASAN UAF confirmed
  with stack trace and reproducer
- [Phase 2] Diff analysis: +6 lines adding `ACPI_GET_DESCRIPTOR_TYPE`
  check before node walk
- [Phase 2] Read current `nsnames.c` lines 193–270 in tree — vulnerable
  code confirmed present
- [Phase 3] `git blame -L 221,245`: buggy loop from `d1e7ffe50ba58`
  (2015)
- [Phase 3] `git merge-base --is-ancestor 96b2b616870e4 HEAD` → FIX NOT
  IN TREE
- [Phase 3] `git apply --check` on patch → CLEAN APPLY
- [Phase 4] `b4 dig -c 96b2b616870e4` → lore URL found; patch 19/27 of
  ACPICA series
- [Phase 4] `b4 dig -w` → Rafael Wysocki, linux-acpi, LKML CC'd
- [Phase 4] Downloaded mbox; grep found no Cc: stable; found related
  patch 12/27
- [Phase 5] `grep acpi_ns_get_normalized_pathname` — multiple kernel
  callers including `extrace.c:284`
- [Phase 5] Read `extrace.c` `acpi_ex_stop_trace_method()` and
  `dsmethod.c:850` call site
- [Phase 5] Confirmed `acpi_ns_get_pathname_length()` already validates
  at line 58; `acpi_ns_get_normalized_pathname()` does not
- [Phase 6] `git describe HEAD` → v6.18.44
- [Phase 6] Confirmed validation check absent in current `nsnames.c`
- [Phase 7] `git log --oneline -20 -- drivers/acpi/acpica/` — active
  subsystem
- [Phase 8] UAF severity assessed from ASAN report in issue #1138

**YES**The analysis is complete for **ACPICA: Add validation for node in
acpi_ns_build_normalized_path()** on **Linux 6.18.44**.

**Summary:** This is a small (6-line) fix for a confirmed heap use-
after-free in ACPI pathname building. The vulnerable code is present in
this tree; the fix is not. It applies cleanly and follows existing
ACPICA validation patterns. Upstream demonstrated the bug with ASAN on
the ACPI AML parse/teardown path (`acpi_ex_stop_trace_method` →
`acpi_ns_get_normalized_pathname` → `acpi_ns_build_normalized_path`).

**Verdict for this tree: YES** — worth backporting as a memory-safety
fix on a common ACPI path.

 drivers/acpi/acpica/nsnames.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/acpi/acpica/nsnames.c b/drivers/acpi/acpica/nsnames.c
index 22aeeeb56cffd..19802da865c54 100644
--- a/drivers/acpi/acpica/nsnames.c
+++ b/drivers/acpi/acpica/nsnames.c
@@ -222,6 +222,12 @@ acpi_ns_build_normalized_path(struct acpi_namespace_node *node,
 		goto build_trailing_null;
 	}
 
+	/* Validate the Node to avoid use-after-free vulnerabilities */
+
+	if (ACPI_GET_DESCRIPTOR_TYPE(node) != ACPI_DESC_TYPE_NAMED) {
+		goto build_trailing_null;
+	}
+
 	next_node = node;
 	while (next_node && next_node != acpi_gbl_root_node) {
 		if (next_node != node) {
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: add boundary checks in acpi_ps_get_next_field()

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit e15aa60de0256d63df2331bf5a4bc4dd287504cd ]

Add boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds
access.

Link: https://github.com/acpica/acpica/commit/c39183ea84bc
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/24388159.6Emhk5qWAg@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: ACPICA boundary checks in
`acpi_ps_get_next_field()`

## Phase 1: Commit Message Forensics

### Step 1.1: Subject Line
**Record:** `[ACPICA] [add] boundary checks in acpi_ps_get_next_field()
to prevent out-of-bounds access`

### Step 1.2: Commit Message Tags
**Record:**
- **Link:** https://github.com/acpica/acpica/commit/c39183ea84bc
  (upstream ACPICA commit)
- **Signed-off-by:** ikaros <void0red@gmail.com> (author)
- **Signed-off-by:** Rafael J. Wysocki <rafael.j.wysocki@intel.com>
  (ACPI maintainer)
- **Link:**
  https://patch.msgid.link/24388159.6Emhk5qWAg@rafael.j.wysocki (Linux
  integration patch reference)
- No `Fixes:`, `Reported-by:`, `Cc: stable@vger.kernel.org`, `Tested-
  by:`, or `Reviewed-by:` tags
- Notable: upstream ACPICA issue **#1125** with ASAN heap-buffer-
  overflow report and reproducible `acpiexec` test case

### Step 1.3: Commit Body Analysis
**Record:**
- **Bug:** `acpi_ps_get_next_field()` reads AML bytes without verifying
  they remain within the AML buffer (`aml_end`)
- **Symptom:** Heap-buffer-overflow (ASAN) when parsing
  malformed/truncated ACPI AML field lists
- **Root cause:** Reads of 1, 2, and 4 bytes proceed without checking
  `parser_state->aml_end`; caller loop uses `pkg_end`, which can extend
  past `aml_end` on corrupt package-length encoding
- **Version info:** None in commit message; bug exists in long-standing
  code (function dates to 2005)

### Step 1.4: Hidden Bug Fix Detection
**Record:** Not disguised — explicitly a defensive boundary-check fix
for out-of-bounds memory access. This is a real memory-safety bug fix,
not cleanup.

---

## Phase 2: Diff Analysis

### Step 2.1: Change Inventory
**Record:**
- **File:** `drivers/acpi/acpica/psargs.c` (+20 / -0)
- **Function:** `acpi_ps_get_next_field()` only
- **Scope:** Single-file, surgical fix

### Step 2.2: Code Flow Changes
**Record:**
1. **Entry check:** Before any AML read, if `aml >=
   parser_state->aml_end`, return NULL
2. **Named field path:** Before 4-byte name read (`ACPI_MOVE_32_TO_32`),
   verify `aml + ACPI_NAMESEG_SIZE <= aml_end`; free allocated op on
   failure
3. **Access field path:** Before reading 2 bytes (type/attribute),
   verify `aml + 2 <= aml_end`; free op on failure
4. **Extended access field:** Before reading third byte
   (`access_length`), verify `aml < aml_end`; free op on failure

**Before → After:** Unbounded AML pointer advancement → bounded reads
with graceful NULL return and proper `acpi_ps_free_op()` cleanup on
post-allocation failures.

### Step 2.3: Bug Mechanism
**Record:**
- **Category:** Buffer overflow / out-of-bounds read (memory safety)
- **Mechanism:** On truncated or malformed AML,
  `acpi_ps_get_next_field()` advances `parser_state->aml` and reads past
  the end of the AML buffer. ASAN report confirms a 4-byte read past a
  175-byte heap allocation at the named-field path.

### Step 2.4: Fix Quality
**Record:**
- Fix is minimal, follows existing `aml_end` semantics used elsewhere in
  ACPICA
- Properly frees `field` on error paths after `acpi_ps_alloc_op()`
  succeeds
- Does not cover every read in the function (e.g.,
  `AML_INT_CONNECTION_OP` sub-paths,
  `acpi_ps_get_next_package_length()`), but addresses the ASAN-confirmed
  overflow sites
- Low regression risk; only adds early-exit guards on malformed input

---

## Phase 3: Git History Investigation

### Step 3.1: Blame
**Record:** Core `acpi_ps_get_next_field()` logic introduced in 2005
(`^1da177e4c3f4`). Buggy unbounded-read pattern has been present since
initial implementation. `parser_state->aml_end` field added long ago and
is set in `dswstate.c`.

### Step 3.2: Fixes: Tag
**Record:** N/A — no `Fixes:` tag in commit message.

### Step 3.3: Related File History
**Record:** Related recent fix in this tree:
- `e6169a8ffee8a` — "ACPICA: Fix memory leak if acpi_ps_get_next_field()
  fails" (April 2024)
  - Ensures caller frees partial field list when
    `acpi_ps_get_next_field()` returns NULL
  - Complements this fix: boundary failure returns NULL, and caller
    already handles that path

### Step 3.4: Author Context
**Record:** Author ikaros reported the bug via ACPICA GitHub issue
#1125. Patch integrated by Rafael J. Wysocki (ACPI subsystem
maintainer). No other commits from this author in the Linux ACPICA tree.

### Step 3.5: Dependencies
**Record:**
- Requires `parser_state->aml_end` in `struct acpi_parse_state` —
  **present** in this tree (`aclocal.h:912`)
- Requires `ACPI_NAMESEG_SIZE` — **present** (used at line 527)
- Requires `acpi_ps_free_op()` — **present**
- Standalone; no patch-series dependency
- **This commit is NOT yet in the local tree** (6.18.44); boundary
  checks absent from current `psargs.c`

---

## Phase 4: Mailing List and External Research

### Step 4.1: Original Discussion
**Record:**
- `b4 dig -c c39183ea84bc` — no match (hash is from upstream ACPICA
  repo, not Linux kernel)
- ACPICA GitHub issue #1125: detailed ASAN report, reproduction with
  `acpiexec -m issue10.aml`, fixed by commit c39183ea84bc
- lore.kernel.org — blocked by bot protection; could not fetch thread

### Step 4.2: Reviewers
**Record:** Rafael J. Wysocki signed off on Linux integration (per
commit message). Full lore review thread unverified due to access block.

### Step 4.3: Bug Report
**Record:**
- **Severity:** Heap-buffer-overflow (ASAN), READ of 4 bytes past
  allocation boundary
- **Reproducible:** Yes, with crafted AML via `acpiexec`
- **Stack trace:** `AcpiPsGetNextField` → `AcpiPsGetNextArg` →
  `AcpiPsGetArguments` → `AcpiPsParseLoop` → `AcpiPsParseAml` → table
  load path

### Step 4.4: Related Patches
**Record:** Standalone fix. Related but separate: memory-leak fix
`e6169a8ffee8a` already in this tree.

### Step 4.5: Stable List Discussion
**Record:** Could not verify stable-list discussion (lore blocked).
Absence of prior stable nomination is not a negative signal per review
guidelines.

---

## Phase 5: Code Semantic Analysis

### Step 5.1: Key Functions
**Record:** `acpi_ps_get_next_field()` (modified), called from
`acpi_ps_get_next_arg()` for `ARGP_FIELDLIST`.

### Step 5.2: Callers
**Record:**
- `acpi_ps_get_next_arg()` — `psargs.c:787`, in `ARGP_FIELDLIST` case
- Called from `acpi_ps_get_arguments()` in `psloop.c`
- Reached during ACPI AML parsing: `acpi_ps_execute_table()` →
  `acpi_ns_parse_table()` → `acpi_ns_load_table()`
- **Context:** ACPI table load at boot (DSDT/SSDT) and dynamic table
  load paths

### Step 5.3: Callees
**Record:** `ACPI_GET8()`, `ACPI_MOVE_32_TO_32()`, `acpi_ps_alloc_op()`,
`acpi_ps_free_op()`, `acpi_ps_get_next_package_length()`,
`acpi_ps_get_next_namestring()`

### Step 5.4: Reachability
**Record:**
- Triggered when kernel parses ACPI AML containing malformed field lists
- ACPI tables come from firmware at boot on virtually all x86/ARM
  systems with ACPI
- Additional paths: `CONFIG_ACPI_TABLE_UPGRADE`, initrd ACPI override
  (`tables.c`), configfs (`acpi_configfs.c`) — root/privileged, but
  firmware-supplied tables are the primary real-world vector
- **Userspace trigger:** Indirect — via firmware/BIOS ACPI tables, not
  direct syscall; still kernel memory safety issue

### Step 5.5: Similar Patterns
**Record:** `aml_end` used as bound in `psloop.c:300`, `dswexec.c:745`,
but **not** in `acpi_ps_get_next_field()` in this tree — this is a gap
the fix addresses.

---

## Phase 6: Cross-Reference Against Local Tree (6.18.44)

### Step 6.1: Buggy Code Present?
**Record:** **YES.** Current `psargs.c` at lines 474–586 performs
unbounded reads in `acpi_ps_get_next_field()` with no `aml_end` checks.
`aml_end` field exists and is initialized in `dswstate.c:580–585`.

### Step 6.2: Backport Complications
**Record:** `git apply --check` on the provided diff — **applies
cleanly** to this tree. No conflicts expected.

### Step 6.3: Related Fixes Already Present?
**Record:** Memory-leak companion fix `e6169a8ffee8a` is present.
Boundary-check fix is **not** present.

---

## Phase 7: Subsystem Context

### Step 7.1: Subsystem Criticality
**Record:** **drivers/acpi/acpica** — ACPI core parser. **Criticality:
CORE/IMPORTANT** — affects all ACPI-enabled systems during table
parsing.

### Step 7.2: Subsystem Activity
**Record:** ACPICA receives periodic syncs from upstream; active
maintenance by Rafael Wysocki's team. Recent related fix (memory leak)
landed in 2024.

---

## Phase 8: Impact and Risk Assessment

### Step 8.1: Who Is Affected
**Record:** All systems using ACPI (majority of PCs, servers, many ARM
boards) when loading ACPI tables with malformed field-list AML.

### Step 8.2: Trigger Conditions
**Record:**
- Malformed/truncated ACPI DSDT/SSDT field definitions
- Most likely: buggy firmware ACPI tables; also crafted tables via
  override mechanisms
- Not every boot — requires specific AML corruption in field lists
- Unprivileged direct trigger unlikely; firmware is primary vector

### Step 8.3: Failure Mode Severity
**Record:**
- **Failure mode:** Out-of-bounds heap read during ACPI AML parsing
- **Severity: HIGH** — memory safety violation; potential info leak or
  crash during boot/table load; ASAN-confirmed

### Step 8.4: Risk-Benefit
**Record:**
- **Benefit: HIGH** — prevents OOB read in widely-used ACPI parser
- **Risk: LOW** — 20-line additive guards, only affects malformed-input
  paths
- **Ratio:** Strongly favors backport

---

## Phase 9: Final Synthesis

### Step 9.1: Evidence Summary

**FOR backport:**
- Real, ASAN-confirmed heap-buffer-overflow
- Fixes memory safety bug in ACPI core parser used at boot
- Small (+20 lines), single file, applies cleanly
- Signed off by ACPI maintainer (Rafael Wysocki)
- Complements existing memory-leak fix already in tree
- `aml_end` infrastructure already present — no structural dependency

**AGAINST backport:**
- Partial coverage (does not add bounds checks to all read paths in the
  function, e.g., connection-op sub-path)
- Trigger primarily via firmware ACPI tables (not direct userspace
  attack)
- NULL return on boundary failure reported as `AE_NO_MEMORY` by caller
  (pre-existing semantic imprecision, not introduced by this patch)

**Unresolved:**
- Full lore.kernel.org review thread not accessible
- Whether Linux mainline has merged this yet (not in 6.18.44)

### Step 9.2: Stable Rules Checklist
1. Obviously correct and tested? **PASS** — straightforward bounds
   checks; ASAN-tested upstream via acpiexec/issue #1125
2. Fixes a real bug? **PASS** — confirmed heap-buffer-overflow
3. Important issue? **PASS** — OOB read in kernel ACPI parser (HIGH
   severity)
4. Small and contained? **PASS** — +20 lines, one function, one file
5. No new features/APIs? **PASS** — defensive checks only
6. Can apply to local tree? **PASS** — verified clean apply;
   prerequisites present

### Step 9.3: Exception Category
**Record:** N/A — standard memory-safety bug fix, not a device-
ID/quirk/DT/build/doc exception.

### Step 9.4: Decision Rationale

This commit fixes a confirmed out-of-bounds heap read in the ACPI AML
field parser — a core subsystem path exercised during every ACPI table
load. The fix is minimal, uses existing `aml_end` bounds infrastructure,
applies cleanly to Linux 6.18.44, and is signed off by the ACPI
maintainer. While the primary trigger is malformed firmware ACPI tables
rather than direct userspace input, heap buffer overflows in kernel
parsers are exactly the class of fixes stable trees exist to deliver.
The companion memory-leak fix is already in this tree, making the NULL-
return error path safe.

---

## Verification

- **[Phase 1]** Parsed commit message and tags; confirmed ASAN report
  via ACPICA GitHub issue #1125
- **[Phase 1]** Identified subsystem (ACPICA), action (add boundary
  checks), bug type (OOB access)
- **[Phase 2]** Diff analysis: +20 lines in `acpi_ps_get_next_field()`,
  4 boundary-check insertion points
- **[Phase 2]** Read current `psargs.c:457-686` — confirmed buggy code
  without bounds checks
- **[Phase 3]** `git describe HEAD` → `v6.18.44`; `make kernelversion` →
  `6.18.44`
- **[Phase 3]** `git blame` on lines 474–590: function code from 2005,
  long-standing vulnerability
- **[Phase 3]** `git log --oneline -20 -- drivers/acpi/acpica/psargs.c`:
  found related fix `e6169a8ffee8a`
- **[Phase 3]** `git show e6169a8ffee8a`: memory-leak fix on NULL return
  from same function
- **[Phase 3]** `git log --grep="boundary checks in
  acpi_ps_get_next_field"`: no match — fix not in tree
- **[Phase 4]** WebFetch ACPICA commit c39183ea84bc and issue #1125:
  ASAN heap-buffer-overflow confirmed
- **[Phase 4]** `b4 dig -c c39183ea84bc`: no Linux kernel match (ACPICA-
  only hash)
- **[Phase 4]** lore.kernel.org fetch: blocked (bot protection) — review
  thread unverified
- **[Phase 5]** Grep callers: `acpi_ps_get_next_field` called from
  `acpi_ps_get_next_arg()` at line 787
- **[Phase 5]** Traced load path: `acpi_ns_load_table` →
  `acpi_ns_parse_table` → `acpi_ps_execute_table`
- **[Phase 5]** Read caller at `psargs.c:780-807`: NULL return handled
  with field-list cleanup
- **[Phase 6]** Confirmed `struct acpi_parse_state` has `aml_end` at
  `aclocal.h:912`
- **[Phase 6]** Confirmed `dswstate.c:580-585` initializes `aml_end`
  from AML buffer length
- **[Phase 6]** `git apply --check` on provided diff: **clean apply**
- **[Phase 6]** Grep `aml >= parser_state->aml_end` in `psargs.c`: no
  matches — fix absent
- **[Phase 8]** Assessed severity: heap OOB read during ACPI parse =
  HIGH

**YES**The analysis is done: **backport recommended** for Linux
**6.18.44**.

The commit adds `aml_end` boundary checks in `acpi_ps_get_next_field()`
to stop out-of-bounds reads when parsing malformed ACPI AML. That’s a
real, ASAN-confirmed heap buffer overflow on the ACPI table load path,
the patch is small (+20 lines), applies cleanly here, and the needed
`aml_end` infrastructure is already in this tree.

**YES**

 drivers/acpi/acpica/psargs.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 6f6ae38ec044c..55273cbbfc67e 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -474,6 +474,10 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
 	ASL_CV_CAPTURE_COMMENTS_ONLY(parser_state);
 	aml = parser_state->aml;
 
+	if (aml >= parser_state->aml_end) {
+		return_PTR(NULL);
+	}
+
 	/* Determine field type */
 
 	switch (ACPI_GET8(parser_state->aml)) {
@@ -522,6 +526,11 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
 
 		/* Get the 4-character name */
 
+		if ((parser_state->aml + ACPI_NAMESEG_SIZE) >
+		    parser_state->aml_end) {
+			acpi_ps_free_op(field);
+			return_PTR(NULL);
+		}
 		ACPI_MOVE_32_TO_32(&name, parser_state->aml);
 		acpi_ps_set_name(field, name);
 		parser_state->aml += ACPI_NAMESEG_SIZE;
@@ -567,6 +576,10 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
 
 		/* Get the two bytes (Type/Attribute) */
 
+		if ((parser_state->aml + 2) > parser_state->aml_end) {
+			acpi_ps_free_op(field);
+			return_PTR(NULL);
+		}
 		access_type = ACPI_GET8(parser_state->aml);
 		parser_state->aml++;
 		access_attribute = ACPI_GET8(parser_state->aml);
@@ -578,6 +591,10 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
 		/* This opcode has a third byte, access_length */
 
 		if (opcode == AML_INT_EXTACCESSFIELD_OP) {
+			if (parser_state->aml >= parser_state->aml_end) {
+				acpi_ps_free_op(field);
+				return_PTR(NULL);
+			}
 			access_length = ACPI_GET8(parser_state->aml);
 			parser_state->aml++;
 
-- 
2.53.0

[PATCH AUTOSEL 6.18-6.12] ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge

[Sasha Levin]

From: Chen Pei <cp0613@linux.alibaba.com>

[ Upstream commit bf5418a5fe63f35da35941ae896d5df121d95ffc ]

CXL root devices (ACPI0017) declare _DEP on their parent ACPI0016
PCI/CXL host bridge so that cxl_acpi probes only after acpi_pci_root
has attached the PCI root and registered it for acpi_pci_find_root().
However, acpi_dev_ready_for_enumeration() only consults dep_unmet
when the supplier's HID is on acpi_honor_dep_ids[]; otherwise the
dependency is silently ignored.

Without honoring the dependency, cxl_acpi can probe before the PCI
root is ready. The resulting CXL topology is broken: decoder targets
read as 0 and no port/endpoint devices appear under
/sys/bus/cxl/devices/.

Add ACPI0016 to acpi_honor_dep_ids[] so the _DEP declared by ACPI0017
is enforced. This relies on the preceding patch ("ACPI: PCI: clear
_DEP dependencies after PCI root bridge attach"), which releases the
dependency once the PCI root is fully enumerated; the two patches
must be applied together.

Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Tested-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260526025118.38935-3-cp0613@linux.alibaba.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL
host bridge

**Local tree:** `v6.18.44` (`stable/linux-6.18.y`, `make kernelversion`
= 6.18.44)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject line
**Record:** `[ACPI: scan]` `[Honor]` — Enforce ACPI `_DEP` dependency
for ACPI0016 (CXL/PCIe host bridge) so ACPI0017 (CXL root) consumers
wait for PCI root attach.

### Step 1.2: Tags
**Record:**
| Tag | Value |
|-----|-------|
| Fixes: | None |
| Reported-by: | None |
| Tested-by: | Alison Schofield \<alison.schofield@intel.com\> |
| Reviewed-by: | Alison Schofield \<alison.schofield@intel.com\> |
| Link: |
https://patch.msgid.link/20260526025118.38935-3-cp0613@linux.alibaba.com
|
| Signed-off-by: | Chen Pei, Rafael J. Wysocki |

**Notable:** Intel CXL maintainer tested and reviewed. No syzbot. No
explicit `Cc: stable`.

### Step 1.3: Body analysis
**Record:**
- **Bug:** ACPI0017 (CXL root) declares `_DEP` on parent ACPI0016, but
  `acpi_dev_ready_for_enumeration()` ignores it because ACPI0016 is not
  in `acpi_honor_dep_ids[]`.
- **Symptom:** `cxl_acpi` probes before `acpi_pci_root` registers the
  PCI root → `acpi_pci_find_root()` returns NULL → broken CXL topology
  (decoder targets = 0, no devices under `/sys/bus/cxl/devices/`).
- **Root cause:** `_DEP` silently ignored for ACPI0016 suppliers.
- **Dependency:** Must be applied with preceding patch "ACPI: PCI: clear
  _DEP dependencies after PCI root bridge attach" (upstream
  `3a59c3b772e5d`).
- **Version info:** None explicit; cover letter says x86 is usually
  masked by link order; RISC-V is affected.

### Step 1.4: Hidden bug fix?
**Record:** No — this is an explicit, well-described functional bug fix
disguised as a one-line allowlist addition.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory
**Record:**
- **Files:** `drivers/acpi/scan.c` (+1 line)
- **Functions:** None modified; only `acpi_honor_dep_ids[]` data changed
- **Scope:** Single-file, surgical (1 insertion)

### Step 2.2: Code flow change
**Record:**
- **Before:** When ACPI0017 declares `_DEP` on ACPI0016,
  `acpi_scan_add_dep()` sets `dep->honor_dep = false` (ACPI0016 not in
  list) → `acpi_dev_ready_for_enumeration()` never blocks on `dep_unmet`
  → CXL root probes early.
- **After:** ACPI0016 in honor list → `honor_dep = true` → consumer
  ACPI0017 blocked until supplier clears dependency.
- **Path affected:** ACPI device enumeration / attach path in
  `acpi_bus_check_add()` via `acpi_dev_ready_for_enumeration()`.

### Step 2.3: Bug mechanism
**Record:**
- **Category:** Logic / correctness — probe ordering / dependency
  enforcement
- **Mechanism:** ACPI `_DEP` declared in firmware is parsed but not
  enforced unless supplier HID is on `acpi_honor_dep_ids[]`. Early
  `cxl_acpi_probe()` calls `to_cxl_host_bridge()` →
  `acpi_pci_find_root()` fails → host bridges skipped silently.

### Step 2.4: Fix quality
**Record:**
- **Quality:** Obviously correct; mirrors existing entries (PNP0C0F,
  RSCV*, INTC*).
- **Regression risk:** Applying **this patch alone** without the
  prerequisite would permanently block ACPI0017 enumeration (confirmed
  in lore review by Alison Schofield). Both patches must ship together.
- **Risk of combined series:** Very low — follows `pci_link.c` / `ec.c`
  pattern already in tree.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:** `acpi_honor_dep_ids[]` introduced by `9d9bcae47fd5a` (2021,
INT3472 camera PMIC deps). PNP0C0F added by `2cb9155d116c4` (2024,
pci_link dep series). ACPI0016 handling in `pci_root.c` since
`241d26bc26add` (2022). CXL ACPI root since `4812be97c015b`. Bug has
been latent since honor-list mechanism existed without ACPI0016 entry.

### Step 3.2: Fixes: tag
**Record:** N/A — no `Fixes:` tag.

### Step 3.3: Related file history
**Record:** Related pending stable commits on `autosel` branch:
- `b52e0117014b6` — ACPI: PCI: Clear _DEP dependencies after PCI root
  bridge attach (prerequisite)
- `82dbacca5220e` — this commit (upstream `bf5418a5fe63f`)

Neither is in current HEAD (`6.18.44`). Part of a 2-patch series (v1,
May 26 2026).

### Step 3.4: Author context
**Record:** Chen Pei (Alibaba). Series reviewed/tested by Alison
Schofield (Intel CXL maintainer) and Reviewed-by Dave Jiang on lore
thread.

### Step 3.5: Dependencies
**Record:** **Hard dependency** on patch 1
(`acpi_dev_clear_dependencies()` in `acpi_pci_root_add()`). Prerequisite
not in tree. Both patches apply cleanly (`git apply --check` passed).
Standalone application of this commit alone is harmful.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original discussion
**Record:**
- `b4 dig -c bf5418a5fe63f` → https://patch.msgid.link/20260526025118.38
  935-3-cp0613@linux.alibaba.com
- Series v1, 2 patches, May 26 2026
- Cover letter explains twofold root cause and mandatory pairing

### Step 4.2: Reviewers
**Record:** CC'd: rafael@kernel.org, bhelgaas@google.com,
djbw@kernel.org, linux-cxl@, linux-acpi@, linux-pci@. Alison Schofield:
Tested-by + Reviewed-by for series. Dave Jiang: Reviewed-by.

### Step 4.3: Bug report
**Record:** No external bugzilla/syzbot. Cover letter documents
reproducible failure: decoder targets = 0, empty
`/sys/bus/cxl/devices/`. Trigger on RISC-V where `acpi_pci_root` vs
`cxl_acpi` link order is not guaranteed.

### Step 4.4: Series context
**Record:** 2-patch series; both required. Applying only patch 2 "would
prevent cxl_acpi from ever probing on ACPI0016 systems" (Alison
Schofield review in mbox).

### Step 4.5: Stable list history
**Record:** No stable@ discussion found in mbox thread. Not a negative
signal per instructions.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key functions
**Record:** `acpi_honor_dep_ids[]` (data), consumed by
`acpi_scan_add_dep()`, `acpi_scan_dep_init()`,
`acpi_dev_ready_for_enumeration()`.

### Step 5.2: Callers
**Record:**
- `acpi_dev_ready_for_enumeration()` called from `acpi_bus_check_add()`
  (scan.c:2288) — core ACPI enumeration path; also `i2c-core-acpi.c`.
- `cxl_acpi_probe()` (drivers/cxl/acpi.c) depends on
  `acpi_pci_find_root()` via `to_cxl_host_bridge()` and
  `add_host_bridge_dport()`.

### Step 5.3: Callees
**Record:** Honor flag flows to `dep->honor_dep` →
`adev->flags.honor_deps` → checked in
`acpi_dev_ready_for_enumeration()`. Clearing via
`acpi_dev_clear_dependencies()` (prerequisite patch).

### Step 5.4: Reachability
**Record:** Triggered at boot during ACPI enumeration on systems with
ACPI0016 + ACPI0017 in DSDT. Affects `CONFIG_CXL_BUS` platforms.
Userspace cannot directly trigger; firmware-defined topology. Common on
CXL-capable servers, especially RISC-V.

### Step 5.5: Similar patterns
**Record:** Identical pattern to PNP0C0F (`2cb9155d116c4`): honor
supplier in list + `acpi_dev_clear_dependencies()` after probe.
Precedent already in 6.18.44.

---

## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE

### Step 6.1: Buggy code present?
**Record:** **YES.** `drivers/acpi/scan.c` lines 857–868 —
`acpi_honor_dep_ids[]` lacks ACPI0016. `drivers/cxl/acpi.c` has ACPI0017
probe path. `drivers/acpi/pci_root.c` handles ACPI0016 but does not call
`acpi_dev_clear_dependencies()`. Full buggy state confirmed in 6.18.44.

### Step 6.2: Backport complications
**Record:** Clean apply for both patches (`git apply --check` exit 0).
No conflicts expected. Minor context: line after PNP0C0F entry.

### Step 6.3: Related fixes already present?
**Record:** Prerequisite infrastructure exists
(`acpi_dev_clear_dependencies`, honor_dep mechanism, pci_link
clear_deps). Neither fix from this series is in HEAD. No duplicate fix
found.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: Subsystem criticality
**Record:** **IMPORTANT** — ACPI core enumeration + CXL driver. Not
universal, but critical for CXL memory users on affected platforms.

### Step 7.2: Activity
**Record:** ACPI scan and CXL actively maintained in 6.18.y (recent
commits: `19b3691ec9402`, `7f0a53c2b94ca` on scan.c; multiple CXL
commits).

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who is affected
**Record:** CXL-capable systems with ACPI0016 host bridges and ACPI0017
root devices — primarily non-x86 (RISC-V called out), but any platform
where probe order differs from x86 link order.

### Step 8.2: Trigger conditions
**Record:** Boot-time ACPI enumeration when ACPI0017 `_DEP` points to
ACPI0016 and `cxl_acpi` probes before `acpi_pci_root` completes. Non-
deterministic on RISC-V; masked on typical x86 by built-in link order.

### Step 8.3: Failure mode severity
**Record:** Complete CXL enumeration failure — no port/endpoint devices,
decoder targets = 0. **Severity: HIGH** for affected CXL users (hardware
non-functional); **MEDIUM** overall (platform-specific, x86 often
unaffected). Not a crash/oops, but total loss of CXL functionality.

### Step 8.4: Risk-benefit
**Record:**
- **Benefit:** HIGH for affected CXL platforms — restores working CXL
  topology
- **Risk:** VERY LOW for combined 2-patch series (5 lines total,
  established pattern)
- **Ratio:** Strongly favorable when both patches applied together

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence summary

**FOR backport:**
- Fixes real, reproducible hardware enablement bug on CXL/ACPI platforms
- Intel CXL maintainer tested and reviewed
- Minimal, obviously correct change (1 line)
- All infrastructure present in 6.18.44
- Applies cleanly; direct precedent (PNP0C0F/pci_link series in tree)
- Prerequisite patch equally small and follows existing
  `ec.c`/`pci_link.c` pattern

**AGAINST backport:**
- Requires paired prerequisite commit (cannot apply alone)
- Bug masked on most x86 systems
- Very new (upstream June 2026, not yet in 6.18.44)
- Niche hardware population (CXL + ACPI0016/0017)

**Unresolved:** No production deployment data beyond Intel testing.

### Step 9.2: Stable rules checklist
| Criterion | Result |
|-----------|--------|
| 1. Obviously correct and tested? | **PASS** — 1-line allowlist;
Tested-by/Reviewed-by Intel CXL maintainer |
| 2. Fixes real bug affecting users? | **PASS** — CXL devices missing on
affected platforms |
| 3. Important issue? | **PASS** — complete CXL enumeration failure
(HIGH for affected users) |
| 4. Small and contained? | **PASS** — 1 line (+ 4 lines prerequisite) |
| 5. No new features/APIs? | **PASS** — enforcement of existing ACPI
`_DEP` mechanism |
| 6. Can apply to local tree? | **PASS** — both patches apply cleanly;
prerequisite must accompany |

### Step 9.3: Exception categories
**Record:** Hardware enablement / probe-order fix for existing CXL ACPI
driver — analogous to USB/PCI quirks and prior PNP0C0F `_DEP` fix.

### Step 9.4: Decision rationale

This commit fixes a genuine ACPI probe-ordering bug that leaves CXL
hardware completely non-functional on platforms (notably RISC-V) where
`cxl_acpi` can run before `acpi_pci_root` finishes. The change is
minimal, follows an established in-tree pattern, and has maintainer
review and testing.

**Critical operational note:** This commit MUST be backported together
with its prerequisite (`ACPI: PCI: Clear _DEP dependencies after PCI
root bridge attach`, upstream `3a59c3b772e5d`). Applying this patch
alone would block `cxl_acpi` from ever probing on ACPI0016 systems, as
explicitly warned in the lore review.

For the 6.18.44 tree, where the buggy code is present and CXL ACPI
support is fully integrated, backporting both patches of this series is
appropriate.

---

## Verification

- [Phase 1] Parsed subject, tags; found Tested-by/Reviewed-by Alison
  Schofield, Link to patch series
- [Phase 1] Cover letter describes broken CXL topology, decoder targets
  = 0
- [Phase 2] Diff: +1 line to `acpi_honor_dep_ids[]` in
  `drivers/acpi/scan.c`
- [Phase 2] Read `acpi_dev_ready_for_enumeration()` at scan.c:2470–2476
  — honors `dep_unmet` only when `honor_deps` set
- [Phase 2] Read `acpi_scan_add_dep()` at scan.c:2035–2036 — sets
  `honor_dep` from list
- [Phase 2] Read `to_cxl_host_bridge()` at cxl/acpi.c:523–533 — requires
  `acpi_pci_find_root()`
- [Phase 3] `git describe HEAD` → v6.18.44
- [Phase 3] `acpi_honor_dep_ids` mechanism from `9d9bcae47fd5a`, in tree
- [Phase 3] ACPI0016 in `pci_root.c` from `241d26bc26add`, in tree
- [Phase 3] CXL ACPI0017 driver from `4812be97c015b`, in tree
- [Phase 3] Commit `bf5418a5fe63f` NOT in HEAD; prerequisite
  `3a59c3b772e5d` NOT in HEAD
- [Phase 3] Both on `autosel` branch as `82dbacca5220e` and
  `b52e0117014b6`
- [Phase 4] `b4 dig -c bf5418a5fe63f` → lore URL; v1 2-patch series
- [Phase 4] `b4 dig -w` → CC'd rafael, bhelgaas, djbw, linux-cxl, linux-
  acpi, linux-pci
- [Phase 4] mbox: Alison Schofield Tested-by/Reviewed-by; warns patch 2
  alone blocks cxl_acpi
- [Phase 4] mbox: RISC-V probe-order issue documented; x86 usually
  masked
- [Phase 5] `acpi_dev_ready_for_enumeration` callers: scan.c:2288,
  i2c-core-acpi.c:155
- [Phase 5] `pci_link.c:751` has `acpi_dev_clear_dependencies()` —
  precedent confirmed
- [Phase 6] Read scan.c:857–868 — ACPI0016 absent from honor list in
  6.18.44
- [Phase 6] Read pci_root.c:760–762 — no `acpi_dev_clear_dependencies()`
  call
- [Phase 6] `git apply --check` for both patches → exit 0 (clean apply)
- [Phase 7] CXL Kconfig exists at `drivers/cxl/Kconfig` (CONFIG_CXL_BUS)
- [Phase 8] Failure mode: complete CXL enumeration failure, not kernel
  crash

**YES**The background searches finished and line up with the earlier
analysis:

- **Git history grep** for ACPI0016-related commits in `drivers/acpi/`
  only turned up the older CXL host-bridge work (`241d26bc26add` — CXL
  `_OSC` handling). Neither of the two `_DEP` fixes showed up in that
  narrow search because they aren’t in the current `6.18.44` HEAD yet.
- **`autosel` branch search** found both patches from the series:
  - `b52e0117014b6` — ACPI: PCI: Clear _DEP dependencies after PCI root
    bridge attach (prerequisite)
  - `82dbacca5220e` — ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host
    bridge (the commit under review)

That confirms the verdict: **YES**, but only as a pair — the
prerequisite must be backported together with this one-patch change to
`acpi_honor_dep_ids[]`.

 drivers/acpi/scan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 16704c2a730c0..a1c8609185d07 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -865,6 +865,7 @@ static const char * const acpi_honor_dep_ids[] = {
 	"RSCV0005", /* RISC-V SBI MPXY MBOX */
 	"RSCV0006", /* RISC-V RPMI SYSMSI */
 	"PNP0C0F",  /* PCI Link Device */
+	"ACPI0016", /* CXL/PCIe host bridge: CXL root (ACPI0017) depends on PCI root attach */
 	NULL
 };
 
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()

[Sasha Levin]

From: ikaros <void0red@gmail.com>

[ Upstream commit b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d ]

Enhance buffer validation in acpi_ut_walk_aml_resources() to prevent
buffer overflows.

Link: https://github.com/acpica/acpica/commit/975cb20c7992
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2481429.NG923GbCHz@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

The background git searches finished and line up with the earlier
analysis:

- **No matching fix in 6.18.44** — searches for “Enhance buffer
  validation” and `AE_AML_BUFFER_LENGTH` usage in `utresrc.c` found
  nothing; the patch is not in this tree yet.
- **Prerequisites are present** — `AE_AML_BUFFER_LENGTH` is already
  defined in `include/acpi/acexcep.h` (since 2018); recent `utresrc.c`
  churn is only pack(1)/alignment work, not this bounds-check fix.
- **Vulnerable code is still there** — the walk loop in
  `acpi_ut_walk_aml_resources()` lacks the new validation.

That supports the **YES** backport verdict for linux-6.18.y: a confirmed
heap-buffer-overflow fix, small and self-contained, with no dependency
blockers in this tree.

 drivers/acpi/acpica/utresrc.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
index e1cc3d3487508..86ebd9fb869af 100644
--- a/drivers/acpi/acpica/utresrc.c
+++ b/drivers/acpi/acpica/utresrc.c
@@ -165,6 +165,28 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
 	/* Walk the byte list, abort on any invalid descriptor type or length */
 
 	while (aml < end_aml) {
+		/*
+		 * Validate that the remaining buffer space can hold enough
+		 * bytes to safely access fields during validation.
+		 * For large resource descriptors (bit 7 set), we need enough
+		 * bytes to access the Type field in serial_bus resources.
+		 * Small resource descriptors only need sizeof(struct aml_resource_end_tag).
+		 */
+		if ((acpi_size)(end_aml - aml) <
+		    sizeof(struct aml_resource_end_tag)) {
+			return_ACPI_STATUS(AE_AML_BUFFER_LENGTH);
+		}
+
+		/*
+		 * For large resource descriptors, ensure enough space for
+		 * the header plus serial_bus Type field access.
+		 */
+		if ((ACPI_GET8(aml) & ACPI_RESOURCE_NAME_LARGE) &&
+		    ((acpi_size)(end_aml - aml) <
+		     ACPI_OFFSET(struct aml_resource_common_serialbus,
+				 type) + 1)) {
+			return_ACPI_STATUS(AE_AML_BUFFER_LENGTH);
+		}
 
 		/* Validate the Resource Type and Resource Length */
 
@@ -182,6 +204,14 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
 
 		length = acpi_ut_get_descriptor_length(aml);
 
+		/*
+		 * Validate that the descriptor length doesn't exceed the
+		 * remaining buffer size to prevent reading beyond the end.
+		 */
+		if (length > (acpi_size)(end_aml - aml)) {
+			return_ACPI_STATUS(AE_AML_BUFFER_LENGTH);
+		}
+
 		/* Invoke the user function */
 
 		if (user_function) {
-- 
2.53.0