Received: by 2002:a05:6358:d09b:b0:dc:cd0c:909e with SMTP id jc27csp1118081rwb; Thu, 8 Dec 2022 07:00:59 -0800 (PST) X-Google-Smtp-Source: AA0mqf540vS0WcEu45DDbhWMEQZfP2FAkP4uHjmlyz0bzIKjnQMibf5WfdK+7uYK5J82XnqVeTfu X-Received: by 2002:a17:903:1014:b0:189:adf6:771d with SMTP id a20-20020a170903101400b00189adf6771dmr36979645plb.102.1670511659579; Thu, 08 Dec 2022 07:00:59 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1670511659; cv=none; d=google.com; s=arc-20160816; b=N7z88gLUPXr7lPqTBPph+yx3TYuLbddWaPPs/wiq/8MaXQQVwSYtMgePrud0khJk0T u7KX6ceuMUqStbJbYGcvFGZhUkwehEADZ5m4VEyadpUAGY0SWvY5tQPRmdxPwyna4mWy QP6nmjLS12D6RvFDbcnjgqrlZkDXFxYVUaPJn3QzqTqXHY3wXz21zkvfU93zZxbKIpH2 RmZ1qtFQlgBaSJ7POCQyewQb3MBEpUZGclA2SIYuevSTLDkynY/CdmFa/OjCg9sFMh1t YP1p205g+IYhuowbd59dxjyJv2c3Hzav87jv/jtRxxIAxX3kG33i71AahjRYIsaUOGDP 23mQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=w+U9odmTKuJujpbOIx+FO+zlMXows+wSBJGw0iybtdA=; b=UHdF7jfYR9olTbzYPLR0iFDfqrA0jiRq2UeOkuXn8eZWQ815B9u9gphSiwXTfb8Cz8 McDolUe9O7JDJrCejSChb9Do1EAZz5UdPJIgDY8Y1FG+7PnbIsjM86Pp0n9Bx4kk2tze DpDSpuyzrXt0gcOjtD6hXips4r9+q3gruIssniomrBUvQht6/1pYJ51/MxBf/rEfVD49 Ld+UYQ+2czpLcVkdAHeG5Qz7A+5ZwXoJuDj4pNGJWsiCkLhUfQRfTzG+wqbDsh9IB/7r hT2as/t3tFj+Cs7kJQ/Bb4RaMBfck8oHQaHOMTX4eRmC5xU1DvwunKgiNRy8jJZrgexn e9dg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=kjJorVeG; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 140-20020a630292000000b004774fa3d9cesi22023724pgc.618.2022.12.08.07.00.21; Thu, 08 Dec 2022 07:00:59 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=kjJorVeG; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229892AbiLHOkA (ORCPT + 73 others); Thu, 8 Dec 2022 09:40:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33936 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229870AbiLHOjp (ORCPT ); Thu, 8 Dec 2022 09:39:45 -0500 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A808C30F67; Thu, 8 Dec 2022 06:39:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1670510384; x=1702046384; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=vZEso0JOtNi2b8BGSXFOJV/zyaEPGuE7SOwhK5XQbE0=; b=kjJorVeGe2ft4VeB7McKJb3tCbvnhYVpXSK10gephzenMbRwLitU96iw +C6rISKC4tgRn22MiJ8rBrOQgQ1jp1D5aqMYyWVd6AcnGrCIaEThL3or9 e2cOD7/E3xrMKoMH1QeAB3E7eIIzO6lv+CdOSpo+CzuTOZdkMIvl+JO4N VjiO0PWYzO9An02xleLNZKLiFCHFeN0mz10I9gvGOskQkhB9RZE7AFDLF L32nxGSNomC7zWen7dQC37o0nUtRrfjPk3eYSlWMXzj81bPRPaINqc9Vl ytPGWUPjsCikOvVEQGOqpheWhY1lmPVq0m2R0fjMcotxQFdhOHEbKPzL0 w==; X-IronPort-AV: E=McAfee;i="6500,9779,10555"; a="314831936" X-IronPort-AV: E=Sophos;i="5.96,227,1665471600"; d="scan'208";a="314831936" Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Dec 2022 06:39:29 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6500,9779,10555"; a="975882631" X-IronPort-AV: E=Sophos;i="5.96,227,1665471600"; d="scan'208";a="975882631" Received: from dev2.igk.intel.com ([10.237.148.94]) by fmsmga005.fm.intel.com with ESMTP; 08 Dec 2022 06:39:27 -0800 From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= To: "Rafael J . Wysocki" , Robert Moore Cc: Len Brown , linux-acpi@vger.kernel.org, devel@acpica.org, linux-kernel@vger.kernel.org, =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= , Cezary Rojewski Subject: [PATCH v2] ACPICA: Fix operand resolution Date: Thu, 8 Dec 2022 23:40:16 +0100 Message-Id: <20221208224016.2009797-1-amadeuszx.slawinski@linux.intel.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-5.1 required=5.0 tests=BAYES_00,DATE_IN_FUTURE_06_12, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In our tests we get UBSAN warning coming from ACPI parser. This is caused by trying to resolve operands when there is none. [ 0.000000] Linux version 5.15.0-rc3chromeavsrel1.0.184+ (root@...) (gcc (Ubuntu 10.3.0-1ubuntu1~20.04) 10.3.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #1 SMP PREEMPT Sat Oct 16 00:08:27 UTC 2021 ... [ 14.719508] ================================================================================ [ 14.719551] UBSAN: array-index-out-of-bounds in /.../linux/drivers/acpi/acpica/dswexec.c:401:12 [ 14.719594] index -1 is out of range for type 'acpi_operand_object *[9]' [ 14.719621] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc3chromeavsrel1.0.184+ #1 [ 14.719657] Hardware name: Intel Corp. Geminilake/GLK RVP2 LP4SD (07), BIOS GELKRVPA.X64.0214.B50.2009111159 09/11/2020 [ 14.719694] Call Trace: [ 14.719712] dump_stack_lvl+0x38/0x49 [ 14.719749] dump_stack+0x10/0x12 [ 14.719775] ubsan_epilogue+0x9/0x45 [ 14.719801] __ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 14.719835] acpi_ds_exec_end_op+0x1d7/0x6b5 [ 14.719870] acpi_ps_parse_loop+0x942/0xb34 ... Problem happens because WalkState->NumOperands is 0 and it is used when trying to access into operands table. Actual code is: WalkState->Operands [WalkState->NumOperands -1] which causes out of bound access. Improve the check before above access to check if ACPI opcode should have any arguments (operands) at all. Link: https://github.com/acpica/acpica/pull/745 Signed-off-by: Amadeusz Sławiński Reviewed-by: Cezary Rojewski --- Changes: v2: Fix comment to tell that opcode has no arguments --- drivers/acpi/acpica/dswexec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/acpi/acpica/dswexec.c b/drivers/acpi/acpica/dswexec.c index e8ad41387f84..b082eb942a0f 100644 --- a/drivers/acpi/acpica/dswexec.c +++ b/drivers/acpi/acpica/dswexec.c @@ -389,9 +389,11 @@ acpi_status acpi_ds_exec_end_op(struct acpi_walk_state *walk_state) /* * All opcodes require operand resolution, with the only exceptions - * being the object_type and size_of operators. + * being the object_type and size_of operators as well as opcodes that + * take no arguments. */ - if (!(walk_state->op_info->flags & AML_NO_OPERAND_RESOLVE)) { + if (!(walk_state->op_info->flags & AML_NO_OPERAND_RESOLVE) && + (walk_state->op_info->flags & AML_HAS_ARGS)) { /* Resolve all operands */ -- 2.25.1