RE: [PATCH] ACPICA: acpica: Fix possible NULL pointer dereference in acpi_ut_remove_reference

[Schmauss, Erik]

> -----Original Message-----
> From: YueHaibing [mailto:yuehaibing@xxxxxxxxxx]
> Sent: Wednesday, May 8, 2019 8:07 AM
> To: Moore, Robert <robert.moore@xxxxxxxxx>; Schmauss, Erik
> <erik.schmauss@xxxxxxxxx>; Wysocki, Rafael J <rafael.j.wysocki@xxxxxxxxx>;
> lenb@xxxxxxxxxx
> Cc: linux-kernel@xxxxxxxxxxxxxxx; devel@xxxxxxxxxx; linux-
> acpi@xxxxxxxxxxxxxxx; YueHaibing <yuehaibing@xxxxxxxxxx>
> Subject: [PATCH] ACPICA: acpica: Fix possible NULL pointer dereference in
> acpi_ut_remove_reference
> 
>  BUG: kernel NULL pointer dereference, address: 0000000000000000
>  #PF: supervisor read access in kernel mode
>  #PF: error_code(0x0000) - not-present page  PGD 0 P4D 0
>  Oops: 0000 [#1
>  CPU: 0 PID: 7393 Comm: modprobe Not tainted 5.1.0+ #34  Hardware name:
> QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-
> prebuilt.qemu-project.org 04/01/2014
>  RIP: 0010:acpi_ut_update_object_reference+0xda/0x1e8
>  Code: 4c 89 e7 eb ea 48 8b 7b 18 48 85 ff 0f 84 95 00 00 00 4c 8b 67 38 44 89 ee
> e8 dd fb ff ff 4c 89 e7 eb e6 48 8b 43 18 44 89 e2 <48> 8b 3c d0 48 85 ff 75 0b 41
> ff c4 44 3b 63 2c 72 e7 eb 66 8a 47
>  RSP: 0018:ffffc90001c9f550 EFLAGS: 00010283
>  RAX: 0000000000000000 RBX: ffff8882310d7288 RCX: 0000000000000000
>  RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8882310d7288
>  RBP: ffffc90001c9f580 R08: 0000000000000000 R09: 0000000000000000
>  R10: 0000000000000001 R11: 000000003ef29b78 R12: 0000000000000000
>  R13: 0000000000000001 R14: ffff88823122e000 R15: 0000000000000000
>  FS:  00007f4469ead540(0000) GS:ffff888237a00000(0000)
> knlGS:0000000000000000
>  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>  CR2: 0000000000000000 CR3: 000000022c2b5000 CR4: 00000000000006f0  Call
> Trace:
>   acpi_ut_remove_reference+0x29/0x2c
>   acpi_ut_copy_iobject_to_iobject+0xd7/0xee
>   acpi_ds_store_object_to_local+0x9a/0x181
>   acpi_ex_store+0x233/0x279
>   ? acpi_ds_create_operands+0x74/0xdb
>   acpi_ex_opcode_1A_1T_1R+0x3c3/0x4fc
>   acpi_ds_exec_end_op+0xd1/0x419
>   acpi_ps_parse_loop+0x532/0x5d0
>   acpi_ps_parse_aml+0x93/0x2c8
>   acpi_ps_execute_method+0x16d/0x1b2
>   acpi_ns_evaluate+0x1c1/0x26c
>   acpi_ut_evaluate_object+0x7d/0x1a4
>   acpi_rs_get_prt_method_data+0x30/0x66
>   acpi_get_irq_routing_table+0x3d/0x56
>   acpi_pci_irq_find_prt_entry+0x8d/0x300
>   ? trace_hardirqs_on+0x3f/0x110
>   acpi_pci_irq_lookup+0x35/0x1f0
>   acpi_pci_irq_enable+0x72/0x1e0
>   ? pci_read_config_word+0x2e/0x30
>   pcibios_enable_device+0x2e/0x40
>   do_pci_enable_device+0x5c/0x100
>   pci_enable_device_flags+0xe0/0x130
>   pci_enable_device+0xe/0x10
>   e1000_probe+0xd2/0xfc0 [e1000
>   ? trace_hardirqs_on+0x3f/0x110
>   local_pci_probe+0x41/0x90
>   pci_device_probe+0x14c/0x1b0
>   really_probe+0x1d4/0x2d0
>   driver_probe_device+0x50/0xf0
>   device_driver_attach+0x54/0x60
>   __driver_attach+0x7e/0xd0
>   ? device_driver_attach+0x60/0x60
>   bus_for_each_dev+0x68/0xc0
>   driver_attach+0x19/0x20
>   bus_add_driver+0x15e/0x200
>   driver_register+0x5b/0xf0
>   __pci_register_driver+0x66/0x70
>   ? 0xffffffffa0179000
>   e1000_init_module+0x50/0x1000 [e1000
>   ? 0xffffffffa0179000
>   do_one_initcall+0x6c/0x3cc
>   ? do_init_module+0x22/0x207
>   ? rcu_read_lock_sched_held+0x97/0xb0
>   ? kmem_cache_alloc_trace+0x325/0x3b0
>   do_init_module+0x5b/0x207
>   load_module+0x1e34/0x2560
>   ? m_show+0x1d0/0x1d0
>   __do_sys_finit_module+0xc5/0xd0
>   __x64_sys_finit_module+0x15/0x20
>   do_syscall_64+0x6b/0x1d0
>   entry_SYSCALL_64_after_hwframe+0x49/0xbe
> 
> In acpi_ut_copy_iobject_to_iobject, if
> acpi_ut_copy_ipackage_to_ipackage failed with AE_NO_MEMORY,
> acpi_ut_remove_reference will be called and in which calls
> acpi_ut_update_object_reference, then it try to dereference 'object-
> >package.elements[i]'
> which trigger NULL pointer dereference.
> 
> Reported-by: Hulk Robot <hulkci@xxxxxxxxxx>
> Fixes: 8aa5e56eeb61 ("ACPICA: Utilities: Fix memory leak in
> acpi_ut_copy_iobject_to_iobject")
> Signed-off-by: YueHaibing <yuehaibing@xxxxxxxxxx>
> ---
>  drivers/acpi/acpica/utcopy.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c index
> 1fb8327..038d518 100644
> --- a/drivers/acpi/acpica/utcopy.c
> +++ b/drivers/acpi/acpica/utcopy.c
> @@ -895,7 +895,6 @@
> 
>  	dest_obj->common.type = source_obj->common.type;
>  	dest_obj->common.flags = source_obj->common.flags;
> -	dest_obj->package.count = source_obj->package.count;
> 
>  	/*
>  	 * Create the object array and walk the source package tree @@ -
> 909,6 +908,8 @@
>  		return_ACPI_STATUS(AE_NO_MEMORY);
>  	}
> 
> +	dest_obj->package.count = source_obj->package.count;
> +
>  	/*
>  	 * Copy the package element-by-element by walking the package
> "tree".
>  	 * This handles nested packages of arbitrary depth.
> --
> 1.8.3.1
> 

Please provide the acpidump as well as the dmesg

Thanks,
Erik