[PATCH v1 10/30] ACPICA: Validate 4-char field names before namespace lookup

[Pawel Chmielewski]

From: ikaros <void0red@xxxxxxxxx>

acpi_ds_get_field_names() and acpi_ds_init_field_objects() pass the
4-byte name of a named field (arg->named.name) to acpi_ns_lookup()
without checking it first. acpi_ns_lookup() treats its argument as an
AML name string. If malformed AML makes the first byte of the field name
AML_DUAL_NAME_PREFIX (0x2E) or AML_MULTI_NAME_PREFIX (0x2F),
acpi_ns_lookup() reads more name segments past the 4-byte name. That is
past the end of the parse object, which is a heap out-of-bounds read.

Before calling acpi_ns_lookup(), check that the field name is a valid
ACPI name segment. Return AE_BAD_CHARACTER if it is not.

Link: https://github.com/acpica/acpica/commit/cd05b72db519
Closes: https://github.com/open-acpica/acpica/issues/1171
Signed-off-by: ikaros <void0red@xxxxxxxxx>
Signed-off-by: Pawel Chmielewski <pawel.chmielewski@xxxxxxxxx>
---
 drivers/acpi/acpica/dsfield.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/acpi/acpica/dsfield.c b/drivers/acpi/acpica/dsfield.c
index d7d56cc600d3..d916ff6dd501 100644
--- a/drivers/acpi/acpica/dsfield.c
+++ b/drivers/acpi/acpica/dsfield.c
@@ -374,6 +374,12 @@ acpi_ds_get_field_names(struct acpi_create_field_info *info,
 
 		case AML_INT_NAMEDFIELD_OP:
 
+			/* Validate the 4-char name to prevent OOB read in acpi_ns_lookup */
+
+			if (!acpi_ut_valid_nameseg((char *)&arg->named.name)) {
+				return_ACPI_STATUS(AE_BAD_CHARACTER);
+			}
+
 			/* Lookup the name, it should already exist */
 
 			status = acpi_ns_lookup(walk_state->scope_info,
@@ -629,6 +635,12 @@ acpi_ds_init_field_objects(union acpi_parse_object *op,
 		 * in the field names in order to enter them into the namespace.
 		 */
 		if (arg->common.aml_opcode == AML_INT_NAMEDFIELD_OP) {
+			/* Validate the 4-char name to prevent OOB read in acpi_ns_lookup */
+
+			if (!acpi_ut_valid_nameseg((char *)&arg->named.name)) {
+				return_ACPI_STATUS(AE_BAD_CHARACTER);
+			}
+
 			status = acpi_ns_lookup(walk_state->scope_info,
 						(char *)&arg->named.name, type,
 						ACPI_IMODE_LOAD_PASS1, flags,
-- 
2.50.1