Re: [PATCH 1/3] ACPICA: Initialize ParserState.AmlEnd in AcpiInstallMethod

[Rafael J. Wysocki (Intel)]

On Mon, Oct 19, 2026 at 4:54 PM Leonard Lausen <leonard@xxxxxxxxx> wrote:
>
> From: Ivan Hu <ivan.hu@xxxxxxxxxxxxx>
>
> In AcpiInstallMethod(), the local ParserState is stack-allocated and
> only ParserState.Aml was initialized. Parser helpers called by this path
> read ParserState.AmlEnd for bounds checking: AcpiPsPeekOpcode() reads it
> before validating the first AML opcode, and AcpiPsGetNextPackageEnd()
> reads it indirectly via AcpiPsGetNextPackageLength(). The subsequent
> package-limit check also compares against ParserState.AmlEnd. Because
> AmlEnd was never set, these checks operated on an uninitialized value,
> which Coverity flagged as an uninitialized read (CID 1684785) and which
> could lead to incorrect parser bounds decisions.
>
> Coverity report:
>
> *** CID 1684785:         Memory - illegal accesses  (UNINIT)
> /src/acpica/source/components/namespace/nsxfname.c: 712             in AcpiInstallMethod()
>         ParserState.Aml += AcpiPsGetOpcodeSize (Opcode);
> >>>     CID 1684785:         Memory - illegal accesses  (UNINIT)
> >>>     Using uninitialized value "ParserState.AmlEnd" when calling
>         "AcpiPsGetNextPackageEnd".
>         ParserState.PkgEnd = AcpiPsGetNextPackageEnd (&ParserState);
>
> Initialize ParserState.AmlEnd to the end of the table
> (Buffer + Table->Length) so the parser bounds checks operate on a valid
> limit.
>
> Link: https://github.com/open-acpica/acpica/commit/19429ef91ebfb2144c918038dce13e297b4ef051
> Fixes: bdc357540129 ("ACPICA: add boundary checks in two places")
> Signed-off-by: Ivan Hu <ivan.hu@xxxxxxxxxxxxx>
> Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@xxxxxxxxx>
> Signed-off-by: Leonard Lausen <leonard@xxxxxxxxx>
> ---
>  drivers/acpi/acpica/nsxfname.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/acpi/acpica/nsxfname.c b/drivers/acpi/acpica/nsxfname.c
> index b6534187cd43..fcd94947fedb 100644
> --- a/drivers/acpi/acpica/nsxfname.c
> +++ b/drivers/acpi/acpica/nsxfname.c
> @@ -503,6 +503,7 @@ acpi_status acpi_install_method(u8 *buffer)
>         /* First AML opcode in the table must be a control method */
>
>         parser_state.aml = buffer + sizeof(struct acpi_table_header);
> +       parser_state.aml_end = buffer + table->length;
>         opcode = acpi_ps_peek_opcode(&parser_state);
>         if (opcode != AML_METHOD_OP) {
>                 return (AE_BAD_PARAMETER);
> --

Applied as 7.4-rc material, thanks!