* [PATCH] ACPICA: Fix missing check for return value of acpi_ns_get_attached_object()
@ 2023-06-14 16:21 Chenyuan Mi
2023-06-14 16:40 ` Rafael J. Wysocki
0 siblings, 1 reply; 2+ messages in thread
From: Chenyuan Mi @ 2023-06-14 16:21 UTC (permalink / raw)
To: robert.moore, rafael.j.wysocki, lenb, linux-acpi, acpica-devel,
linux-kernel
Cc: Chenyuan Mi
The acpi_ns_get_attached_object() function may return
NULL, which may cause null pointer deference, and most
other callsites of acpi_ns_get_attached_object() do
Null check. Add Null check for return value of
acpi_ns_get_attached_object().
Found by our static analysis tool.
Signed-off-by: Chenyuan Mi <cymi20@fudan.edu.cn>
---
drivers/acpi/acpica/exprep.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c
index 08196fa17080..d9c006ec1ac8 100644
--- a/drivers/acpi/acpica/exprep.c
+++ b/drivers/acpi/acpica/exprep.c
@@ -431,6 +431,13 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info)
obj_desc->field.region_obj =
acpi_ns_get_attached_object(info->region_node);
+ if (!obj_desc->field.region_obj) {
+ ACPI_ERROR((AE_INFO,
+ "Null Region Object during field prep"));
+ acpi_ut_delete_object_desc(obj_desc);
+ return_ACPI_STATUS(AE_AML_INTERNAL);
+ }
+
/* Fields specific to generic_serial_bus fields */
obj_desc->field.access_length = info->access_length;
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ACPICA: Fix missing check for return value of acpi_ns_get_attached_object()
2023-06-14 16:21 [PATCH] ACPICA: Fix missing check for return value of acpi_ns_get_attached_object() Chenyuan Mi
@ 2023-06-14 16:40 ` Rafael J. Wysocki
0 siblings, 0 replies; 2+ messages in thread
From: Rafael J. Wysocki @ 2023-06-14 16:40 UTC (permalink / raw)
To: Chenyuan Mi
Cc: robert.moore, rafael.j.wysocki, lenb, linux-acpi, acpica-devel,
linux-kernel
On Wed, Jun 14, 2023 at 6:21 PM Chenyuan Mi <cymi20@fudan.edu.cn> wrote:
>
> The acpi_ns_get_attached_object() function may return
> NULL, which may cause null pointer deference, and most
> other callsites of acpi_ns_get_attached_object() do
> Null check. Add Null check for return value of
> acpi_ns_get_attached_object().
But may acpi_ex_prep_field_value() be called in a code path where
acpi_ns_get_attached_object(i) can return NULL?
I mean, if the given attached object is guaranteed to exist when this
function is called, NULL will not be returned, so the new check will
be redundant then.
> Found by our static analysis tool.
>
> Signed-off-by: Chenyuan Mi <cymi20@fudan.edu.cn>
> ---
> drivers/acpi/acpica/exprep.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c
> index 08196fa17080..d9c006ec1ac8 100644
> --- a/drivers/acpi/acpica/exprep.c
> +++ b/drivers/acpi/acpica/exprep.c
> @@ -431,6 +431,13 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info)
> obj_desc->field.region_obj =
> acpi_ns_get_attached_object(info->region_node);
>
> + if (!obj_desc->field.region_obj) {
> + ACPI_ERROR((AE_INFO,
> + "Null Region Object during field prep"));
> + acpi_ut_delete_object_desc(obj_desc);
> + return_ACPI_STATUS(AE_AML_INTERNAL);
> + }
> +
> /* Fields specific to generic_serial_bus fields */
>
> obj_desc->field.access_length = info->access_length;
> --
> 2.17.1
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-06-14 16:42 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-06-14 16:21 [PATCH] ACPICA: Fix missing check for return value of acpi_ns_get_attached_object() Chenyuan Mi
2023-06-14 16:40 ` Rafael J. Wysocki
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).