[PATCH] dispatcher: Fix NULL pointer dereference in AcpiDsTerminateControlMethod()

[Zijing Yin <yzjaurora@gmail.com>]

If AcpiUtCreateThreadState() fails in AcpiPsParseAml(), the error path
calls AcpiDsTerminateControlMethod() before WalkState->Thread is set.
A top-level method invocation creates its walk state without a thread,
so for a Serialized method the sync level restore dereferences NULL:

    WalkState->Thread->CurrentSyncLevel =
        MethodDesc->Method.Mutex->Mutex.OriginalSyncLevel;

I ran into this while fuzzing Linux, where reading the "status" sysfs
attribute of an ACPI device with a Serialized _STA oopses when that
allocation fails:

  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001
  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
  RIP: 0010:acpi_ds_terminate_control_method+0x7ae/0xa80
  Call Trace:
   <TASK>
   acpi_ps_parse_aml+0xece/0x1170
   acpi_ps_execute_method+0x5c4/0xe90
   acpi_ns_evaluate+0x633/0x16d0
   acpi_evaluate_object+0x4ca/0xdf0
   acpi_evaluate_integer+0xdd/0x230
   status_show+0xa0/0x120
   </TASK>

For a top-level call, AcpiDsBeginMethodExecution() gets no walk state
and does not take OriginalSyncLevel from a thread. Here there is no
thread to restore it to either, so skip the restore when
WalkState->Thread is NULL, but keep releasing the mutex, since
AcpiDsBeginMethodExecution() did acquire it.

Fixes: 2107ff8b75d3 ("Fix possible memory leak on error in parser.")
Signed-off-by: Zijing Yin <yzjaurora@gmail.com>
---
On Linux with fault injection, 3 of 3 boots oopsed without this patch
and none did with it. It also reproduces in acpiexec by making
AcpiUtCreateThreadState() fail once for a Serialized method.

Reproducer (gcc -static; needs CONFIG_FAULT_INJECTION, CONFIG_FAILSLAB
and CONFIG_FAULT_INJECTION_DEBUG_FS, run as root). It reads every ACPI
device's "status" attribute with the Nth allocation forced to fail, N
counting down from 128. On QEMU the CPU _STA methods are Serialized:

	#include <dirent.h>
	#include <fcntl.h>
	#include <stdio.h>
	#include <unistd.h>

	int main(void)
	{
		char path[512], buf[256];
		struct dirent *e;
		int fd, nth, n, failed = 0;
		DIR *d;

		/* let fail-nth fail GFP_KERNEL allocations too */
		fd = open("/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY);
		if (fd < 0 || write(fd, "N", 1) != 1) {
			perror("failslab/ignore-gfp-wait");
			return 1;
		}
		close(fd);

		d = opendir("/sys/bus/acpi/devices");
		while (d && (e = readdir(d))) {
			snprintf(path, sizeof(path), "/sys/bus/acpi/devices/%s/status",
				 e->d_name);
			for (n = 128; n >= 1; n--) {
				fd = open(path, O_RDONLY);
				if (fd < 0)
					break;
				nth = open("/proc/thread-self/fail-nth", O_WRONLY);
				dprintf(nth, "%d", n);
				if (read(fd, buf, sizeof(buf)) < 0)
					failed++;
				dprintf(nth, "0");
				close(nth);
				close(fd);
			}
		}
		printf("done, %d reads failed\n", failed);
		return 0;
	}

If you prefer a GitHub PR for this, I can open one.

 source/components/dispatcher/dsmethod.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/source/components/dispatcher/dsmethod.c b/source/components/dispatcher/dsmethod.c
index caad11543..96d92454e 100644
--- a/source/components/dispatcher/dsmethod.c
+++ b/source/components/dispatcher/dsmethod.c
@@ -866,8 +866,17 @@ AcpiDsTerminateControlMethod (
             MethodDesc->Method.Mutex->Mutex.AcquisitionDepth--;
             if (!MethodDesc->Method.Mutex->Mutex.AcquisitionDepth)
             {
-                WalkState->Thread->CurrentSyncLevel =
-                    MethodDesc->Method.Mutex->Mutex.OriginalSyncLevel;
+                /*
+                 * There is no thread state if AcpiPsParseAml() failed to
+                 * create one. AcpiDsBeginMethodExecution() did not take
+                 * OriginalSyncLevel from a thread in that case, and there
+                 * is no thread to restore it to now.
+                 */
+                if (WalkState->Thread)
+                {
+                    WalkState->Thread->CurrentSyncLevel =
+                        MethodDesc->Method.Mutex->Mutex.OriginalSyncLevel;
+                }
 
                 AcpiOsReleaseMutex (
                     MethodDesc->Method.Mutex->Mutex.OsMutex);

base-commit: 98bbab7dbae0ff7941c4cf08d46f5d30978f809e