iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
361c89a0da
linux/drivers/acpi/acpica
History
Li Zetao 470188b09e ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() 
There is an use-after-free reported by KASAN:

  BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82
  Read of size 1 at addr ffff888112afc460 by task modprobe/2111
  CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
  Call Trace:
   <TASK>
   kasan_report+0xae/0xe0
   acpi_ut_remove_reference+0x3b/0x82
   acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5
   acpi_ds_store_object_to_local+0x15d/0x3a0
   acpi_ex_store+0x78d/0x7fd
   acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b
   acpi_ps_parse_aml+0x217/0x8d5
   ...
   </TASK>

The root cause of the problem is that the acpi_operand_object
is freed when acpi_ut_walk_package_tree() fails in
acpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in
acpi_ut_copy_iobject_to_iobject(). The problem was introduced
by "8aa5e56eeb61" commit, this commit is to fix memory leak in
acpi_ut_copy_iobject_to_iobject(), repeatedly adding remove
operation, lead to "acpi_operand_object" used after free.

Fix it by removing acpi_ut_remove_reference() in
acpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage()
is called to copy an internal package object into another internal
package object, when it fails, the memory of acpi_operand_object
should be freed by the caller.

Fixes: 8aa5e56eeb ("ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject")
Signed-off-by: Li Zetao <lizetao1@huawei.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-12-02 20:32:38 +01:00
..
acapps.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
accommon.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acconvert.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acdebug.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acdispat.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acevents.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acglobal.h ACPICA: Finish support for the CDAT table 2022-10-28 17:28:23 +02:00
achware.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acinterp.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
aclocal.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acmacros.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acnamesp.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acobject.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acopcode.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acparser.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acpredef.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acresrc.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
acstruct.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
actables.h ACPICA: Finish support for the CDAT table 2022-10-28 17:28:23 +02:00
acutils.h ACPICA: Finish support for the CDAT table 2022-10-28 17:28:23 +02:00
amlcode.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
amlresrc.h ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dbcmds.c
dbconvert.c ACPICA: debugger: remove leading whitespaces when converting a string to a buffer 2019-10-28 22:12:46 +01:00
dbdisply.c ACPICA: iASL: add new OperationRegion subtype keyword PlatformRtMechanism 2020-06-05 13:34:23 +02:00
dbexec.c ACPICA: Debugger: Add a new command: "ALL <NameSeg>" 2020-10-08 18:03:55 +02:00
dbfileio.c ACPICA: make acpi_load_table() return table index 2019-10-28 22:12:46 +01:00
dbhistry.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dbinput.c ACPICA: add type casts for string functions 2021-01-22 15:51:53 +01:00
dbmethod.c ACPICA: Debugger: Add a new command: "ALL <NameSeg>" 2020-10-08 18:03:55 +02:00
dbnames.c ACPICA: debugger: surround field unit output with braces '{' 2019-10-28 22:12:46 +01:00
dbobject.c ACPICA: Clean up exception code class checks 2021-01-18 16:01:10 +01:00
dbstats.c ACPICA: Fully deploy ACPI_PRINTF_LIKE macro 2019-08-21 00:00:37 +02:00
dbtest.c ACPICA: Debugger: Fix possible fault with the "test objects" command 2019-02-18 11:21:10 +01:00
dbutils.c
dbxface.c ACPICA: acpiexec: remove redeclaration of acpi_gbl_db_opt_no_region_support 2020-03-30 14:52:32 +02:00
dsargs.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dscontrol.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dsdebug.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dsfield.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dsinit.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dsmethod.c ACPICA: Fix error code path in acpi_ds_call_control_method() 2022-11-08 20:37:23 +01:00
dsmthdat.c
dsobject.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dsopcode.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dspkginit.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dsutils.c ACPICA: Remove defines that use deprecated flag 2018-12-13 22:40:51 +01:00
dswexec.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dswload2.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dswload.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dswscope.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
dswstate.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evevent.c ACPICA: Events: Support fixed PCIe wake event 2022-10-28 17:28:22 +02:00
evglock.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evgpe.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evgpeblk.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evgpeinit.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evgpeutil.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evhandler.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evmisc.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evregion.c ACPICA: Add support for FFH Opregion special context data 2022-10-28 17:28:22 +02:00
evrgnini.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evsci.c
evxface.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evxfevnt.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evxfgpe.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
evxfregn.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exconcat.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exconfig.c ACPICA: Make acpi_ex_load_op() match upstream 2022-10-28 17:27:04 +02:00
exconvrt.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
excreate.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exdebug.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exdump.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exfield.c ACPICA: Add support for FFH Opregion special context data 2022-10-28 17:28:22 +02:00
exfldio.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exmisc.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exmutex.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exnames.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exoparg1.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exoparg2.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exoparg3.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exoparg6.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exprep.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exregion.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exresnte.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exresolv.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exresop.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exserial.c ACPICA: Add support for FFH Opregion special context data 2022-10-28 17:28:22 +02:00
exstore.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exstoren.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exstorob.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exsystem.c Revert "ACPICA: executer/exsystem: Warn about sleeps greater than 10 ms" 2022-05-21 18:02:26 +02:00
extrace.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
exutils.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
hwacpi.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
hwesleep.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
hwgpe.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
hwpci.c
hwregs.c ACPICA: Clean up double word in comment 2022-04-13 20:24:57 +02:00
hwsleep.c ACPICA: Events: Support fixed PCIe wake event 2022-10-28 17:28:22 +02:00
hwtimer.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
hwvalid.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
hwxface.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
hwxfsleep.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
Makefile ACPICA: Finish support for the CDAT table 2022-10-28 17:28:23 +02:00
nsaccess.c ACPICA: Always create namespace nodes using acpi_ns_create_node() 2021-03-24 14:50:54 +01:00
nsalloc.c ACPICA: Remove unnecessary semicolon 2020-10-08 18:03:56 +02:00
nsarguments.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nsconvert.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nsdump.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nsdumpdv.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nseval.c ACPICA: remove legacy module-level code due to deprecation 2019-07-04 00:59:43 +02:00
nsinit.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nsload.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nsnames.c ACPICA: Fixes for acpiExec namespace init file 2020-03-30 14:52:33 +02:00
nsobject.c ACPICA: Namespace: remove address node from global list after method termination 2019-04-09 10:05:11 +02:00
nsparse.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nspredef.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nsprepkg.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nsrepair2.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nsrepair.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nssearch.c ACPICA: Revert "iASL: change processing of external op namespace nodes for correctness" 2018-07-09 11:14:45 +02:00
nsutils.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nswalk.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nsxfeval.c
nsxfname.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
nsxfobj.c ACPICA: Tree-wide: fix various typos and spelling mistakes 2020-10-08 18:03:55 +02:00
psargs.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
psloop.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
psobject.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
psopcode.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
psopinfo.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
psparse.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
psscope.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
pstree.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
psutils.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
pswalk.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
psxface.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
rsaddr.c
rscalc.c ACPICA: ACPI 6.4: add CSI2Bus resource template 2021-04-07 19:09:01 +02:00
rscreate.c ACPICA: More Clang changes 2019-10-28 22:12:46 +01:00
rsdump.c ACPICA: ACPI 6.4: add CSI2Bus resource template 2021-04-07 19:09:01 +02:00
rsdumpinfo.c ACPICA: ACPI 6.4: add CSI2Bus resource template 2021-04-07 19:09:01 +02:00
rsinfo.c ACPICA: ACPI 6.4: add CSI2Bus resource template 2021-04-07 19:09:01 +02:00
rsio.c
rsirq.c ACPI/ACPICA: Trivial: fix spelling mistakes and fix whitespace formatting 2019-02-24 21:12:01 +01:00
rslist.c ACPICA: ACPI 6.4: add CSI2Bus resource template 2021-04-07 19:09:01 +02:00
rsmemory.c
rsmisc.c ACPICA: ACPI 6.4: add CSI2Bus resource template 2021-04-07 19:09:01 +02:00
rsserial.c ACPICA: ACPI 6.4: add CSI2Bus resource template 2021-04-07 19:09:01 +02:00
rsutils.c
rsxface.c ACPICA: Rename nameseg compare macro for clarity 2019-04-09 10:08:28 +02:00
tbdata.c ACPICA: Finish support for the CDAT table 2022-10-28 17:28:23 +02:00
tbfadt.c ACPICA: Finish support for the CDAT table 2022-10-28 17:28:23 +02:00
tbfind.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
tbinstal.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
tbprint.c ACPICA: Finish support for the CDAT table 2022-10-28 17:28:23 +02:00
tbutils.c ACPICA: Finish support for the CDAT table 2022-10-28 17:28:23 +02:00
tbxface.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
tbxfload.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
tbxfroot.c ACPICA: Finish support for the CDAT table 2022-10-28 17:28:23 +02:00
utaddress.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utalloc.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utascii.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utbuffer.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utcache.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utcksum.c ACPICA: Finish support for the CDAT table 2022-10-28 17:28:23 +02:00
utcopy.c ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() 2022-12-02 20:32:38 +01:00
utdebug.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utdecode.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utdelete.c ACPICA: Utilities: Avoid deleting the same object twice in a row 2021-12-27 17:01:28 +01:00
uterror.c ACPICA: Increase total number of possible Owner IDs 2019-08-21 00:00:36 +02:00
uteval.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utexcep.c
utglobal.c ACPICA: Events: Support fixed PCIe wake event 2022-10-28 17:28:22 +02:00
uthex.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utids.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utinit.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utlock.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utmath.c
utmisc.c ACPICA: Rename nameseg compare macro for clarity 2019-04-09 10:08:28 +02:00
utmutex.c
utnonansi.c
utobject.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utosi.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utownerid.c ACPICA: Increase total number of possible Owner IDs 2019-08-21 00:00:36 +02:00
utpredef.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utprint.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utresdecode.c ACPICA: ACPI 6.4: add CSI2Bus resource template 2021-04-07 19:09:01 +02:00
utresrc.c ACPICA: ACPI 6.4: add CSI2Bus resource template 2021-04-07 19:09:01 +02:00
utstate.c
utstring.c ACPICA: Improve warning message for "invalid ACPI name" 2022-10-28 17:28:23 +02:00
utstrsuppt.c ACPICA: add type casts for string functions 2021-01-22 15:51:53 +01:00
utstrtoul64.c ACPICA: Utilities: split hex detection into smaller functions 2018-08-14 23:49:13 +02:00
uttrack.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utuuid.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utxface.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utxferror.c ACPICA: Convert more ACPI errors to firmware errors 2019-01-15 18:04:02 +01:00
utxfinit.c ACPICA: Update copyright notices to the year 2022 2022-04-13 20:24:57 +02:00
utxfmutex.c