Skip to content

Commit 6fcab27

Browse files
committed
ACPICA: Refuse to evaluate a method if arguments are missing
As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of its callers, caused ACPICA to crash due to use-after-free. Since this a result of a clear AML issue that arguably cannot be fixed up by the interpreter (it cannot produce missing data out of thin air), address it by making ACPICA refuse to evaluate a method if the caller attempts to pass fewer arguments than expected to it. Closes: acpica/acpica#1027 [1] Reported-by: Peter Williams <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]> Reviewed-by: Hans de Goede <[email protected]> Tested-by: Hans de Goede <[email protected]> # Dell XPS 9640 with BIOS 1.12.0 Link: https://patch.msgid.link/[email protected] Signed-off-by: Rafael J. Wysocki <[email protected]>
1 parent e04c78d commit 6fcab27

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

drivers/acpi/acpica/dsmethod.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -483,6 +483,13 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
483483
return_ACPI_STATUS(AE_NULL_OBJECT);
484484
}
485485

486+
if (this_walk_state->num_operands < obj_desc->method.param_count) {
487+
ACPI_ERROR((AE_INFO, "Missing argument for method [%4.4s]",
488+
acpi_ut_get_node_name(method_node)));
489+
490+
return_ACPI_STATUS(AE_AML_UNINITIALIZED_ARG);
491+
}
492+
486493
/* Init for new method, possibly wait on method mutex */
487494

488495
status =

0 commit comments

Comments
 (0)