Received: by 2002:a05:6a10:af89:0:0:0:0 with SMTP id iu9csp3677291pxb; Mon, 24 Jan 2022 15:07:10 -0800 (PST) X-Google-Smtp-Source: ABdhPJzDIxbRtpVpAUyunFpcWqTeMs74I0WuCoO2wbjeq3kiS4M1r7KP99alfh3csOBokZEoAKdb X-Received: by 2002:a63:534f:: with SMTP id t15mr13213189pgl.327.1643065630650; Mon, 24 Jan 2022 15:07:10 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1643065630; cv=none; d=google.com; s=arc-20160816; b=hNRlt8jjJ9/5E6pGjy0e2OxT/O5v/9cyPcB8zX5mbsF/EIqwQhRdNjopvm6n6/K46m az7OpQ5HlxWm0RFUcOQO0vUzMxWR49LhosOM4GoXklv4sLY0dzbU0dyWZCGdBowzhgXk WXexyE1v824x/lEIxXWGGGf1SRw68faYv6s9Q+4z/+KLPSZ6Wy/ZtHAM1oc0qD7up6i2 L2LJVoYZcXjm4YcegNJriGldvYVcEeetMkckKoM4ju6ef0oRtXRGnXNCBW/BwLZQRwZp CaIIbQyHnsldHw/CuVL3PkOGMcKYpKDb3aueY99yDVkHha/XZ6n4yvB8DYl2x/M6n/db oriA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=YSxFJZrHTZrM6N9n+CGh8FiDPk+0KQhY4bDYxi488Ow=; b=kQt5m2VQppqI377xL6O9WIlcKBiqfBHurHitPO/8HvP3cLPNN+E/iFYDdsttZrw33T O60wXZ0/0O2j7CJgd7nVlaCSoP4KdWXOlnnkaDTCR2ukHmhScKGu172Xtv9WwXPm8eFz //7KtV7eysn7xJETm87MhaZF47C8rZXGp5AZJngMM5X/orZlTwYkK4AT5DsvTPUitsxO TCFrTxz9PE/Zmr65O0JXeeFP2e1Ffu5AvFeuPdS4Gi6dK5ZG7bbp7hltWD2so+qyJCf7 +kM1rJ50GT5wUlIqa+z7s78fkP5IfM34qWGcm80ysZ52VpWVHA/l7T6fY+AF04R675XV Tkdw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Nt6oV2pO; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id w76si11946127pff.130.2022.01.24.15.06.29; Mon, 24 Jan 2022 15:07:10 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Nt6oV2pO; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1842959AbiAXXDB (ORCPT + 99 others); Mon, 24 Jan 2022 18:03:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59504 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1574933AbiAXV7G (ORCPT ); Mon, 24 Jan 2022 16:59:06 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 53DEFC02B8C4; Mon, 24 Jan 2022 12:39:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CAA7EB811FB; Mon, 24 Jan 2022 20:39:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01E93C340E5; Mon, 24 Jan 2022 20:39:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643056757; bh=RrkQfr1N8/D9I56nK7YQ11YiOSyDN+pImc2mLPrVi0M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nt6oV2pOroFqKlgSmfNrX5gI+VLaoGd2p40qcLR0SalB0bi2/6HS4EbTbDdHH6yYe WfKoSLewVg0jiPGOKzrvJikjo6z4G8DjH63ICwI7aWqdFlsoCYgMzvkxDmLzkc0RXu PjKPXdgU4ofuumxBwc5YXXOJJ53y/dzDEOXuLhEE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lenny Szubowicz , "Rafael J. Wysocki" , Bob Moore , Sasha Levin Subject: [PATCH 5.15 591/846] ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() Date: Mon, 24 Jan 2022 19:41:48 +0100 Message-Id: <20220124184121.419404333@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124184100.867127425@linuxfoundation.org> References: <20220124184100.867127425@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Rafael J. Wysocki [ Upstream commit 24ea5f90ec9548044a6209685c5010edd66ffe8f ] ACPICA commit d984f12041392fa4156b52e2f7e5c5e7bc38ad9e If Operand[0] is a reference of the ACPI_REFCLASS_REFOF class, acpi_ex_opcode_1A_0T_1R () calls acpi_ns_get_attached_object () to obtain return_desc which may require additional resolution with the help of acpi_ex_read_data_from_field (). If the latter fails, the reference counter of the original return_desc is decremented which is incorrect, because acpi_ns_get_attached_object () does not increment the reference counter of the object returned by it. This issue may lead to premature deletion of the attached object while it is still attached and a use-after-free and crash in the host OS. For example, this may happen when on evaluation of ref_of() a local region field where there is no registered handler for the given Operation Region. Fix it by making acpi_ex_opcode_1A_0T_1R () return Status right away after a acpi_ex_read_data_from_field () failure. Link: https://github.com/acpica/acpica/commit/d984f120 Link: https://github.com/acpica/acpica/pull/685 Reported-by: Lenny Szubowicz Signed-off-by: Rafael J. Wysocki Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin --- drivers/acpi/acpica/exoparg1.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c index b639e930d6429..44b7c350ed5ca 100644 --- a/drivers/acpi/acpica/exoparg1.c +++ b/drivers/acpi/acpica/exoparg1.c @@ -1007,7 +1007,8 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state) (walk_state, return_desc, &temp_desc); if (ACPI_FAILURE(status)) { - goto cleanup; + return_ACPI_STATUS + (status); } return_desc = temp_desc; -- 2.34.1