In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix NULL pointer dereference in acpievaddressspacedispatch()
Cover a missed execution path with a new check.
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: ACPICA: check null return of ACPIALLOCATEZEROED in acpidbdisplayobjects
ACPICA commit 0d5f467d6a0ba852ea3aad68663cbcbd43300fd4
ACPIALLOCATEZEROED may fails, objectinfo might be null and will cause null pointer dereference later.
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Add AMLNOOPERANDRESOLVE flag to Timer
ACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5
According to the ACPI specification 19.6.134, no argument is required to be passed for ASL Timer instruction. For taking care of no argument, AMLNOOPERANDRESOLVE flag is added to ASL Timer instruction opcode.
When ASL timer instruction interpreted by ACPI interpreter, getting error. After adding AMLNOOPERANDRESOLVE flag to ASL Timer instruction opcode, issue is not observed.
============================================================= UBSAN: array-index-out-of-bounds in acpica/dswexec.c:401:12 index -1 is out of range for type 'union acpioperandobject [9]' CPU: 37 PID: 1678 Comm: cat Not tainted 6.0.0-dev-th500-6.0.y-1+bcf8c46459e407-generic-64k HW name: NVIDIA BIOS v1.1.1-d7acbfc-dirty 12/19/2022 Call trace: dumpbacktrace+0xe0/0x130 showstack+0x20/0x60 dumpstacklvl+0x68/0x84 dumpstack+0x18/0x34 ubsanepilogue+0x10/0x50 ubsanhandleoutofbounds+0x80/0x90 acpidsexecendop+0x1bc/0x6d8 acpipsparseloop+0x57c/0x618 acpipsparseaml+0x1e0/0x4b4 acpipsexecutemethod+0x24c/0x2b8 acpinsevaluate+0x3a8/0x4bc acpievaluateobject+0x15c/0x37c acpievaluateinteger+0x54/0x15c showpower+0x8c/0x12c [acpipowermeter]
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Avoid undefined behavior: applying zero offset to null pointer
ACPICA commit 770653e3ba67c30a629ca7d12e352d83c2541b1e
Before this change we see the following UBSAN stack trace in Fuchsia:
#0 0x000021e4213b3302 in acpidsinitamlwalk(struct acpiwalkstate, union acpiparseobject, struct acpinamespacenode, u8, u32, struct acpievaluateinfo, u8) ../../thirdparty/acpica/source/components/dispatcher/dswstate.c:682 <platform-bus-x86.so>+0x233302 #1.2 0x000020d0f660777f in ubsangetstacktrace() compiler-rt/lib/ubsan/ubsandiag.cpp:41 <libclangrt.asan.so>+0x3d77f #1.1 0x000020d0f660777f in maybeprintstacktrace() compiler-rt/lib/ubsan/ubsandiag.cpp:51 <libclangrt.asan.so>+0x3d77f #1 0x000020d0f660777f in ~scopedreport() compiler-rt/lib/ubsan/ubsandiag.cpp:387 <libclangrt.asan.so>+0x3d77f #2 0x000020d0f660b96d in handlepointeroverflowimpl() compiler-rt/lib/ubsan/ubsanhandlers.cpp:809 <libclangrt.asan.so>+0x4196d #3 0x000020d0f660b50d in compiler-rt/lib/ubsan/ubsanhandlers.cpp:815 <libclangrt.asan.so>+0x4150d #4 0x000021e4213b3302 in acpidsinitamlwalk(struct acpiwalkstate, union acpiparseobject, struct acpinamespacenode, u8, u32, struct acpievaluateinfo, u8) ../../thirdparty/acpica/source/components/dispatcher/dswstate.c:682 <platform-bus-x86.so>+0x233302 #5 0x000021e4213e2369 in acpidscallcontrolmethod(struct acpithreadstate, struct acpiwalkstate, union acpiparseobject) ../../thirdparty/acpica/source/components/dispatcher/dsmethod.c:605 <platform-bus-x86.so>+0x262369 #6 0x000021e421437fac in acpipsparseaml(struct acpiwalkstate) ../../thirdparty/acpica/source/components/parser/psparse.c:550 <platform-bus-x86.so>+0x2b7fac #7 0x000021e4214464d2 in acpipsexecutemethod(struct acpievaluateinfo) ../../thirdparty/acpica/source/components/parser/psxface.c:244 <platform-bus-x86.so>+0x2c64d2 #8 0x000021e4213aa052 in acpinsevaluate(struct acpievaluateinfo) ../../thirdparty/acpica/source/components/namespace/nseval.c:250 <platform-bus-x86.so>+0x22a052 #9 0x000021e421413dd8 in acpinsinitonedevice(acpihandle, u32, void, void) ../../thirdparty/acpica/source/components/namespace/nsinit.c:735 <platform-bus-x86.so>+0x293dd8 #10 0x000021e421429e98 in acpinswalknamespace(acpiobjecttype, acpihandle, u32, u32, acpiwalkcallback, acpiwalkcallback, void, void) ../../thirdparty/acpica/source/components/namespace/nswalk.c:298 <platform-bus-x86.so>+0x2a9e98 #11 0x000021e4214131ac in acpinsinitializedevices(u32) ../../thirdparty/acpica/source/components/namespace/nsinit.c:268 <platform-bus-x86.so>+0x2931ac #12 0x000021e42147c40d in acpiinitializeobjects(u32) ../../thirdparty/acpica/source/components/utilities/utxfinit.c:304 <platform-bus-x86.so>+0x2fc40d #13 0x000021e42126d603 in acpi::acpiimpl::initializeacpi(acpi::acpiimpl) ../../src/devices/board/lib/acpi/acpi-impl.cc:224 <platform-bus-x86.so>+0xed603
Add a simple check that avoids incrementing a pointer by zero, but otherwise behaves as before. Note that our findings are against ACPICA 20221020, but the same code exists on master.