From: Seraphime Kirkovski <kirkseraph@gmail.com>
To: devel@acpica.org, linux-acpi@vger.kernel.org
Cc: robert.moore@intel.com, lv.zheng@intel.com,
rafael.j.wysocki@intel.com, lenb@kernel.org,
linux-kernel@vger.kernel.org,
Seraphime Kirkovski <kirkseraph@gmail.com>
Subject: [PATCH] acpi: acpica: dsutils: fix an off-by-one index
Date: Tue, 6 Jun 2017 23:59:51 +0200 [thread overview]
Message-ID: <20170606215951.3429-1-kirkseraph@gmail.com> (raw)
This was detected by UBSAN.
Fix it by checking whether there are any arguments prior to indexing the array.
[ 0.222775] UBSAN: Undefined behaviour in drivers/acpi/acpica/dsutils.c:640:16
[ 0.222778] index -1 is out of range for type 'acpi_operand_object*[9]'
[ 0.222781] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc4-dirty #32
[ 0.222782] Hardware name: Hewlett-Packard HP EliteBook 2560p/162B, BIOS 68SSU Ver. F.02 07/26/2011
[ 0.222783] Call Trace:
[ 0.222790] dump_stack+0x4e/0x78
[ 0.222792] ubsan_epilogue+0xd/0x40
[ 0.222794] __ubsan_handle_out_of_bounds+0x68/0x80
[ 0.222795] ? perf_trace_sys_exit+0x12d/0x170
[ 0.222797] ? kmem_cache_alloc+0x1e6/0x2e0
[ 0.222800] acpi_ds_create_operand+0x20b/0x2a6
[ 0.222801] acpi_ds_eval_data_object_operands+0x58/0x16c
[ 0.222803] acpi_ds_exec_end_op+0x424/0x582
[ 0.222805] acpi_ps_parse_loop+0x730/0x792
[ 0.222807] acpi_ps_parse_aml+0xac/0x2eb
[ 0.222809] acpi_ds_execute_arguments+0x129/0x14d
[ 0.222810] acpi_ds_get_buffer_arguments+0x62/0x65
[ 0.222812] acpi_ns_init_one_object+0xe0/0x13b
[ 0.222814] acpi_ns_walk_namespace+0x121/0x1ef
[ 0.222815] ? acpi_ns_exec_module_code_list+0x1b7/0x1b7
[ 0.222817] ? acpi_ns_exec_module_code_list+0x1b7/0x1b7
[ 0.222818] acpi_walk_namespace+0xa0/0xd5
[ 0.222820] acpi_ns_initialize_objects+0x37/0x5a
[ 0.222823] acpi_initialize_objects+0x34/0x54
[ 0.222824] ? acpi_sleep_proc_init+0x2d/0x2d
[ 0.222826] acpi_init+0xcb/0x34d
[ 0.222828] ? __class_create+0x54/0x80
[ 0.222830] ? fbmem_init+0x7f/0xd4
[ 0.222831] ? acpi_sleep_proc_init+0x2d/0x2d
[ 0.222832] do_one_initcall+0x52/0x1d0
[ 0.222835] kernel_init_freeable+0x314/0x3a6
[ 0.222837] ? rest_init+0x80/0x80
[ 0.222838] kernel_init+0xf/0x120
[ 0.222839] ? rest_init+0x80/0x80
[ 0.222841] ret_from_fork+0x22/0x30
Signed-off-by: Seraphime Kirkovski <kirkseraph@gmail.com>
---
drivers/acpi/acpica/dsutils.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/acpi/acpica/dsutils.c b/drivers/acpi/acpica/dsutils.c
index 406edec20de7..b66eddd3df6e 100644
--- a/drivers/acpi/acpica/dsutils.c
+++ b/drivers/acpi/acpica/dsutils.c
@@ -636,11 +636,10 @@ acpi_ds_create_operand(struct acpi_walk_state *walk_state,
ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
"Argument previously created, already stacked\n"));
- acpi_db_display_argument_object(walk_state->
- operands[walk_state->
- num_operands -
- 1],
- walk_state);
+ if (walk_state->num_operands)
+ acpi_db_display_argument_object(walk_state->
+ operands[walk_state->num_operands - 1],
+ walk_state);
/*
* Use value that was already previously returned
--
2.11.0
next reply other threads:[~2017-06-06 22:00 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-06 21:59 Seraphime Kirkovski [this message]
2017-06-07 15:14 ` Moore, Robert
2017-06-07 17:18 ` [PATCH] acpi: acpica: dsutils: fixanoff-by-one index Seraphime Kirkovski
2017-06-08 7:31 ` Zheng, Lv
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170606215951.3429-1-kirkseraph@gmail.com \
--to=kirkseraph@gmail.com \
--cc=devel@acpica.org \
--cc=lenb@kernel.org \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lv.zheng@intel.com \
--cc=rafael.j.wysocki@intel.com \
--cc=robert.moore@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®