2024-04-03 01:50:49

by Huai-Yuan Liu

Subject: [PATCH] ACPICA: debugger: dbconvert: add a null pointer check

The memory allocation function ACPI_ALLOCATE_ZEROED does not guarantee a
successful allocation, but the subsequent code directly dereferences the
pointer that receives it, which may lead to null pointer dereference.

To fix this issue, a null pointer check should be added. If it is null,
return exception code AE_NO_MEMORY.

Fixes: 995751025572 ("ACPICA: Linuxize: Export debugger files to Linux")
Signed-off-by: Huai-Yuan Liu <[email protected]>
---
drivers/acpi/acpica/dbconvert.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/acpi/acpica/dbconvert.c b/drivers/acpi/acpica/dbconvert.c
index 2b84ac093698..8dbab6932049 100644
--- a/drivers/acpi/acpica/dbconvert.c
+++ b/drivers/acpi/acpica/dbconvert.c
@@ -174,6 +174,8 @@ acpi_status acpi_db_convert_to_package(char *string, union acpi_object *object)
elements =
ACPI_ALLOCATE_ZEROED(DB_DEFAULT_PKG_ELEMENTS *
sizeof(union acpi_object));
+ if (!elements)
+ return (AE_NO_MEMORY);

this = string;
for (i = 0; i < (DB_DEFAULT_PKG_ELEMENTS - 1); i++) {
--
2.34.1

2024-04-08 14:32:59

by Rafael J. Wysocki

Subject: Re: [PATCH] ACPICA: debugger: dbconvert: add a null pointer check

On Wed, Apr 3, 2024 at 3:43 AM Huai-Yuan Liu <[email protected]> wrote:
>
> The memory allocation function ACPI_ALLOCATE_ZEROED does not guarantee a
> successful allocation, but the subsequent code directly dereferences the
> pointer that receives it, which may lead to null pointer dereference.
>
> To fix this issue, a null pointer check should be added. If it is null,
> return exception code AE_NO_MEMORY.
>
> Fixes: 995751025572 ("ACPICA: Linuxize: Export debugger files to Linux")
> Signed-off-by: Huai-Yuan Liu <[email protected]>

Because ACPICA is an external project supplying code to the Linux
kernel, the way to change the ACPICA code in the kernel is to submit a
pull request to the upstream ACPICA project on GitHub and once that PR
has been merged, submit a Linux patch corresponding to it including
the Link: tag pointing to the PR in question and the git ID of the
corresponding upstream ACPICA commit.

However, note that upstream ACPICA changes are applied to the Linux
kernel source code every time the upstream ACPICA project makes a
release, so it is not necessary to send the corresponding Linux
patches for them unless in the cases when timing matters.

> ---
> drivers/acpi/acpica/dbconvert.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/acpi/acpica/dbconvert.c b/drivers/acpi/acpica/dbconvert.c
> index 2b84ac093698..8dbab6932049 100644
> --- a/drivers/acpi/acpica/dbconvert.c
> +++ b/drivers/acpi/acpica/dbconvert.c
> @@ -174,6 +174,8 @@ acpi_status acpi_db_convert_to_package(char *string, union acpi_object *object)
> elements =
> ACPI_ALLOCATE_ZEROED(DB_DEFAULT_PKG_ELEMENTS *
> sizeof(union acpi_object));
> + if (!elements)
> + return (AE_NO_MEMORY);
>
> this = string;
> for (i = 0; i < (DB_DEFAULT_PKG_ELEMENTS - 1); i++) {
> --
> 2.34.1
>
>