Forwarded: Re: [syzbot] [acpica?] KASAN: use-after-free Read in acpi_ns_get_attached_object

[syzbot <syzbot+5725792ce6a9938d1b24@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: Re: [syzbot] [acpica?] KASAN: use-after-free Read in acpi_ns_get_attached_object
Author: jeff@incrediblybased.co

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

diff --git a/drivers/acpi/acpica/utdelete.c
b/drivers/acpi/acpica/utdelete.c index e818009..28a13f0 100644
--- a/drivers/acpi/acpica/utdelete.c
+++ b/drivers/acpi/acpica/utdelete.c
@@ -558,12 +558,18 @@ acpi_ut_update_object_reference(union
acpi_operand_object *object, u16 action)
/*
* For complex sub-objects, push them onto the stack
* for later processing (this eliminates recursion.)
+ * If no state can be allocated, update the sub-object
+ * right away. Abandoning the walk here would leave
+ * this object and the remaining sub-objects with
+ * unbalanced reference counts.
*/
status =
acpi_ut_create_update_state_and_push
(next_object, action, &state_list);
if (ACPI_FAILURE(status)) {
- goto error_exit;
+ (void)
+ acpi_ut_update_object_reference
+ (next_object, action);
}
break;
}
@@ -587,7 +593,10 @@ acpi_ut_update_object_reference(union
acpi_operand_object *object, u16 action)
action,
&state_list);
if (ACPI_FAILURE(status)) {
- goto error_exit;
+ (void)acpi_ut_update_object_reference(object->
+ bank_field.
+ region_obj,
+ action);
}
break;

@@ -601,7 +610,10 @@ acpi_ut_update_object_reference(union
acpi_operand_object *object, u16 action)
action,
&state_list);
if (ACPI_FAILURE(status)) {
- goto error_exit;
+ (void)acpi_ut_update_object_reference(object->
+ index_field.
+ data_obj,
+ action);
}
break;

@@ -645,20 +657,6 @@ acpi_ut_update_object_reference(union
acpi_operand_object *object, u16 action)
}

return (AE_OK);
-
-error_exit:
-
- ACPI_EXCEPTION((AE_INFO, status,
- "Could not update object reference count"));
-
- /* Free any stacked Update State objects */
-
- while (state_list) {
- state = acpi_ut_pop_generic_state(&state_list);
- acpi_ut_delete_generic_state(state);
- }
-
- return (status);
}

/*******************************************************************************