From: Cryolitia PukNgae via B4 Relay <devnull+cryolitia.uniontech.com@kernel.org>
To: "Rafael J. Wysocki" <rafael@kernel.org>,
Robert Moore <robert.moore@intel.com>,
Len Brown <lenb@kernel.org>
Cc: linux-acpi@vger.kernel.org, acpica-devel@lists.linux.dev,
linux-kernel@vger.kernel.org, wangyuli@uniontech.com,
guanwentao@uniontech.com, niecheng1@uniontech.com,
zhanjun@uniontech.com,
Cryolitia PukNgae <cryolitia@uniontech.com>
Subject: [PATCH] ACPICA: add more parameter validation for acpi_walk_namespace()
Date: Fri, 15 Aug 2025 16:56:39 +0800 [thread overview]
Message-ID: <20250815-acpi_fix-v1-1-a05ebfe1b8ac@uniontech.com> (raw)
From: Cryolitia PukNgae <cryolitia@uniontech.com>
On the Honor FMB-P-PCB laptop, an incorrect ACPI table causes
sdw_intel_acpi_scan to pass a NULL pointer as start_object to
acpi_walk_namespace() when calling it, which eventually causes the
kernel to report a NULL pointer dereference[1].
1. https://gist.github.com/Cryolitia/a860ffc97437dcd2cd988371d5b73ed7
Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
---
drivers/acpi/acpica/nsxfeval.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
index f9d059647cc52e94ce013af3382addba338820e8..c1f318ea7d5fcd846dc158b155286a6f5bba4cff 100644
--- a/drivers/acpi/acpica/nsxfeval.c
+++ b/drivers/acpi/acpica/nsxfeval.c
@@ -564,7 +564,7 @@ acpi_walk_namespace(acpi_object_type type,
/* Parameter validation */
- if ((type > ACPI_TYPE_LOCAL_MAX) ||
+ if ((type > ACPI_TYPE_LOCAL_MAX) || (start_object == NULL) ||
(!max_depth) || (!descending_callback && !ascending_callback)) {
return_ACPI_STATUS(AE_BAD_PARAMETER);
}
---
base-commit: 24ea63ea387714634813359e2c8e0e6c36952f73
change-id: 20250815-acpi_fix-3724e6c4da02
Best regards,
--
Cryolitia PukNgae <cryolitia@uniontech.com>
next reply other threads:[~2025-08-15 8:56 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-15 8:56 Cryolitia PukNgae via B4 Relay [this message]
2025-08-25 15:00 ` Rafael J. Wysocki
2025-08-26 2:00 ` Cryolitia PukNgae
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250815-acpi_fix-v1-1-a05ebfe1b8ac@uniontech.com \
--to=devnull+cryolitia.uniontech.com@kernel.org \
--cc=acpica-devel@lists.linux.dev \
--cc=cryolitia@uniontech.com \
--cc=guanwentao@uniontech.com \
--cc=lenb@kernel.org \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=niecheng1@uniontech.com \
--cc=rafael@kernel.org \
--cc=robert.moore@intel.com \
--cc=wangyuli@uniontech.com \
--cc=zhanjun@uniontech.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®