ACPI: ACPICA: Reset can delete an event semaphore while another thread is blocked in Wait

[徐晗翔 <xuhx@hust.edu.cn>]

[-- Attachment #1: Type: text/plain, Size: 5981 bytes --]

acpi_ex_system_reset_event() creates a new semaphore, deletes the old
one, and replaces obj_desc->event.os_semaphore without checking whether
a Wait is already blocked on the old pointer.  A waiting thread takes
the old semaphore pointer, drops the ACPICA interpreter lock, and
blocks in down_timeout(); Reset can then call
acpi_os_delete_semaphore(), whose BUG_ON(sem->first_waiter) and
kfree(sem) are performed without sem->lock.  If the waiter is already
queued the BUG_ON fires; if the check passes before the waiter is
queued, the waiter uses freed memory.  The BUG_ON was reproduced on a
KASAN 7.3 guest with a custom SSDT and a module driving concurrent
Wait/Reset, not just inferred from the source.

The detailed description:

* Test environment / affected version

  Linux 7.3.0 (mainline 7.3 source, unmodified), KASAN build from
  verification/build-kasan-7.3, x86_64 QEMU/KVM guest, 2 vCPU,
  CONFIG_KASAN=y, CONFIG_BUG=y.  A test SSDT was loaded with QEMU's
  -acpitable option and provided a device \_SB.TST0 with _HID
  "RAC0001", Event(EVT0), Method(MWAI) executing
  Wait(EVT0, 0xFFFFFFFF), and Method(MRST) executing Reset(EVT0).
  The module acpi_case5.ko calls MWAI from one kthread, waits one
  second for the waiter to block, and calls MRST from the main thread.
  Line numbers are from Linux 7.3.

* Mechanism

  1. Wait.  acpi_ex_system_wait_semaphore()
     (drivers/acpi/acpica/exsystem.c:31-59) first tries
     acpi_os_wait_semaphore(..., ACPI_DO_NOT_WAIT).  On AE_TIME it
     calls acpi_ex_exit_interpreter(), which drops
     ACPI_MTX_NAMESPACE and ACPI_MTX_INTERPRETER
     (drivers/acpi/acpica/exutils.c:93-110), then blocks in
     acpi_os_wait_semaphore(semaphore, 1, timeout).  The semaphore
     argument is the old pointer read before the interpreter lock was
     dropped.

  2. Reset.  acpi_ex_system_reset_event()
     (drivers/acpi/acpica/exsystem.c:261-280) does:

       status = acpi_os_create_semaphore(..., &temp_semaphore);
       if (ACPI_SUCCESS(status)) {
               (void)acpi_os_delete_semaphore(obj_desc->event.os_semaphore);
               obj_desc->event.os_semaphore = temp_semaphore;
       }

     It does not take a per-event lock, does not check for waiters,
     does not wake or cancel them, and ignores the delete result.

  3. Delete.  acpi_os_delete_semaphore()
     (drivers/acpi/osl.c:1245-1271) contains the kernel's own TODO
     about non-synchronized consumers:

       BUG_ON(sem->first_waiter);
       kfree(sem);
       sem = NULL;

     The BUG_ON is an unlocked read and kfree() follows immediately.
     down_timeout() checks sem->count under sem->lock and, if it must
     block, chains the waiter into sem->first_waiter under the same
     lock (kernel/locking/semaphore.c:198-211 and 276-284).
     acpi_os_delete_semaphore() does not take sem->lock, so "no waiter
     at the check" does not imply "no waiter at kfree".

  Two interleavings matter:

    A. Waiter already queued.  Wait has linked its waiter into
       first_waiter and is sleeping; Reset deletes the old semaphore;
       BUG_ON(first_waiter) fires.  With CONFIG_BUG=y this is an oops,
       and panic_on_oops=1 turns it into a panic.

    B. Delete wins the check.  BUG_ON sees NULL, kfree(old_sem) runs,
       and only then does the waiter enter __down_timeout() and take
       old_sem->lock / write old_sem->first_waiter.  This is a UAF and
       can corrupt the wait list or the raw spinlock.

  Signal is not the primary trigger.  acpi_ex_system_signal_event()
  (exsystem.c:199-215) also reads obj_desc->event.os_semaphore, but it
  runs under the ACPICA interpreter lock, so it cannot overlap Reset's
  delete.  After Reset replaces the pointer, Signal operates on the new
  semaphore and can leave the old waiter without a wakeup; that is an
  event-semantics/liveness bug, not the UAF above.

  The utdelete path (drivers/acpi/acpica/utdelete.c:153-161) also
  deletes an event semaphore, but it requires the operand object's
  refcount to reach zero while a Wait is using it; that is a narrower
  and less direct path, so it is not the main trigger here.


* Reproducer (attached: acpi_case5.c) and results on 7.3

  The attached module is self-contained and uses the test SSDT
  described above:

    insmod /acpi_case5.ko

  It resolves \_SB.TST0 with acpi_get_handle(), starts a kthread that
  evaluates MWAI (Wait), sleeps one second, then evaluates MRST
  (Reset) from the module's main thread.  Actual serial output
  (trimmed):

    ACPI_CASE5: get_handle st=0
    ACPI_CASE5: waiter evaluating MWAI
    ACPI_CASE5: evaluating MRST while waiter blocked
    kernel BUG at drivers/acpi/osl.c:1266!
    Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
    RIP: 0010:acpi_os_delete_semaphore+0x90/0xa0
    Call Trace:
     acpi_ex_system_reset_event+0xcd/0xf0
     acpi_ex_opcode_1A_0T_0R
     acpi_ps_parse_loop
     acpi_ps_execute_method
     acpi_ns_evaluate
     acpi_evaluate_object
     init_module+0xa0/0xff0 [acpi_case5]

  This is the "waiter already queued" interleaving, not the UAF
  interleaving B.  It proves that Reset can reach delete with a
  non-empty waiter list and that the BUG_ON is not a theoretical
  assertion.  It does not prove a user-triggerable path: the custom
  SSDT and module are test harnesses.



* Suggested direction

  Give the event object a lock or reference that covers Wait, Signal,
  Reset, and destruction; make Reset either wait for/cancel all
  waiters or replace the semaphore atomically while Wait revalidates
  the pointer under the same lock.  Do not use BUG_ON(first_waiter) as
  a lifetime check: delete should take sem->lock, wake/cancel queued
  waiters, and wait for them to leave before freeing.  Alternatively,
  use a completion or another primitive with a defined destroy
  protocol.  Report-first, no patch attached; happy to test any
  proposal.



  Please keep me in Cc; I am not subscribed to the lists.



Regards,
Hanxiang Xu
xuhx@hust.edu.cn

[-- Attachment #2: acpi_case5.c --]
[-- Type: text/plain, Size: 1233 bytes --]

// SPDX-License-Identifier: GPL-2.0
#include <linux/module.h>
#include <linux/kthread.h>
#include <linux/delay.h>
#include <linux/acpi.h>
#include <acpi/acpi_bus.h>

static acpi_handle test_handle;

static int acpi_wait_thread(void *data)
{
	acpi_status st;

	pr_info("ACPI_CASE5: waiter evaluating MWAI\n");
	st = acpi_evaluate_object(test_handle, "MWAI", NULL, NULL);
	pr_info("ACPI_CASE5: waiter returned st=%d\n", st);
	return 0;
}

static int __init acpi_case5_init(void)
{
	struct task_struct *t;
	acpi_status st;

	st = acpi_get_handle(NULL, "\\_SB.TST0", &test_handle);
	pr_info("ACPI_CASE5: get_handle st=%d handle=%px\n", st, test_handle);
	if (ACPI_FAILURE(st))
		return -ENODEV;

	t = kthread_run(acpi_wait_thread, NULL, "acpi_case5_wait");
	if (IS_ERR(t))
		return PTR_ERR(t);

	msleep(1000);
	pr_info("ACPI_CASE5: evaluating MRST while waiter blocked\n");
	st = acpi_evaluate_object(test_handle, "MRST", NULL, NULL);
	pr_info("ACPI_CASE5: MRST returned st=%d\n", st);
	msleep(1000);
	return 0;
}

static void __exit acpi_case5_exit(void)
{
	pr_info("ACPI_CASE5: unload\n");
}

module_init(acpi_case5_init);
module_exit(acpi_case5_exit);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("ACPI event Reset-vs-Wait race probe");