Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
From:   Tong Zhang <ztong0001@gmail.com>
To:     Robert Moore <robert.moore@intel.com>,
        "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
        Len Brown <lenb@kernel.org>, linux-acpi@vger.kernel.org,
        devel@acpica.org, linux-kernel@vger.kernel.org
Cc:     Tong Zhang <ztong0001@gmail.com>
Subject: [PATCH] ACPICA: proactively check null ptr to avoid API misuse
Date:   Tue, 15 Feb 2022 22:26:15 -0800
Message-Id: <20220216062615.779778-1-ztong0001@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

There are some cases that user use acpi_ns_walk_namespace() without
checking acpi_disable flag. When acpi=off is provided in boot cmdline,
acpi_gbl_root_node is NULL and calling acpi_ns_walk_namespace() will
crash kernel. In order to avoid such misuse, we proactively check null ptr
and return an error when we know ACPI is disabled.

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
---
 drivers/acpi/acpica/nswalk.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c
index 915c2433463d..9ae45db16d86 100644
--- a/drivers/acpi/acpica/nswalk.c
+++ b/drivers/acpi/acpica/nswalk.c
@@ -171,6 +171,13 @@ acpi_ns_walk_namespace(acpi_object_type type,
 		start_node = acpi_gbl_root_node;
 	}
 
+	/* acpi_gbl_root_node is NULL when acpi=off is provided.
+	 * We proactively check nulliness here and return an error if user call
+	 * this function without checking acpi_disabled
+	 */
+	if (start_node == NULL)
+		return_ACPI_STATUS(AE_ERROR);
+
 	/* Null child means "get first node" */
 
 	parent_node = start_node;
-- 
2.25.1