From: "Rafael J. Wysocki" <rafael@kernel.org>
To: Chenyuan Mi <cymi20@fudan.edu.cn>
Cc: rafael.j.wysocki@intel.com, robert.moore@intel.com,
linux-kernel@vger.kernel.org, linux-acpi@vger.kernel.org,
acpica-devel@lists.linuxfoundation.org, lenb@kernel.org
Subject: Re: [Acpica-devel] [PATCH] ACPICA: Fix missing check for return value of acpi_ns_get_attached_object()
Date: Wed, 14 Jun 2023 18:40:39 +0200 [thread overview]
Message-ID: <CAJZ5v0iZMHmgGE7ZTmOghHtWPXECx5HFt2a1NBNwABBX0CQBeg@mail.gmail.com> (raw)
In-Reply-To: <20230614162112.122816-1-cymi20@fudan.edu.cn>
On Wed, Jun 14, 2023 at 6:21 PM Chenyuan Mi <cymi20@fudan.edu.cn> wrote:
>
> The acpi_ns_get_attached_object() function may return
> NULL, which may cause null pointer deference, and most
> other callsites of acpi_ns_get_attached_object() do
> Null check. Add Null check for return value of
> acpi_ns_get_attached_object().
But may acpi_ex_prep_field_value() be called in a code path where
acpi_ns_get_attached_object(i) can return NULL?
I mean, if the given attached object is guaranteed to exist when this
function is called, NULL will not be returned, so the new check will
be redundant then.
> Found by our static analysis tool.
>
> Signed-off-by: Chenyuan Mi <cymi20@fudan.edu.cn>
> ---
> drivers/acpi/acpica/exprep.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c
> index 08196fa17080..d9c006ec1ac8 100644
> --- a/drivers/acpi/acpica/exprep.c
> +++ b/drivers/acpi/acpica/exprep.c
> @@ -431,6 +431,13 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info)
> obj_desc->field.region_obj =
> acpi_ns_get_attached_object(info->region_node);
>
> + if (!obj_desc->field.region_obj) {
> + ACPI_ERROR((AE_INFO,
> + "Null Region Object during field prep"));
> + acpi_ut_delete_object_desc(obj_desc);
> + return_ACPI_STATUS(AE_AML_INTERNAL);
> + }
> +
> /* Fields specific to generic_serial_bus fields */
>
> obj_desc->field.access_length = info->access_length;
> --
> 2.17.1
>
next prev parent reply other threads:[~2023-06-14 16:40 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-14 16:21 [Acpica-devel] [PATCH] ACPICA: Fix missing check for return value of acpi_ns_get_attached_object() Chenyuan Mi
2023-06-14 16:40 ` Rafael J. Wysocki [this message]
2023-06-15 7:41 ` 20210240143
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAJZ5v0iZMHmgGE7ZTmOghHtWPXECx5HFt2a1NBNwABBX0CQBeg@mail.gmail.com \
--to=rafael@kernel.org \
--cc=acpica-devel@lists.linuxfoundation.org \
--cc=cymi20@fudan.edu.cn \
--cc=lenb@kernel.org \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rafael.j.wysocki@intel.com \
--cc=robert.moore@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).