[PATCH v1 23/30] ACPICA: namespace: Fix possible underflow and NULL pointer dereference

[Pawel Chmielewski]

From: Maciej Wieczor-Retman <maciej.wieczor-retman@xxxxxxxxx>

AcpiPsGetNextNamestring modifies ParserState.Aml. Since it can take on
the AmlEnd value, further instruction that do Aml++ can cause underflows
on pointer arithmetic that's done to calculate AmlLength. Also the
return value can be NULL which is not checked currently.

Verify that return value is not NULL and check if ParserState.Aml can be
incremented safely.

Link: https://github.com/acpica/acpica/commit/ff5efd5d4ee3
Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@xxxxxxxxx>
Signed-off-by: Pawel Chmielewski <pawel.chmielewski@xxxxxxxxx>
---
 drivers/acpi/acpica/nsxfname.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/acpi/acpica/nsxfname.c b/drivers/acpi/acpica/nsxfname.c
index fcd94947fedb..c0466139fd96 100644
--- a/drivers/acpi/acpica/nsxfname.c
+++ b/drivers/acpi/acpica/nsxfname.c
@@ -519,6 +519,14 @@ acpi_status acpi_install_method(u8 *buffer)
 	}
 	path = acpi_ps_get_next_namestring(&parser_state);
 
+	/*
+	 * Path can be NULL, and Aml can be pkg_end which combined with the Aml++
+	 * a few lines below will cause aml_length to underflow.
+	 */
+	if (!path || (parser_state.aml >= parser_state.pkg_end)) {
+		return (AE_AML_PACKAGE_LIMIT);
+	}
+
 	method_flags = *parser_state.aml++;
 	aml_start = parser_state.aml;
 	aml_length = (u32)ACPI_PTR_DIFF(parser_state.pkg_end, aml_start);
-- 
2.50.1