Seunghun Han
9c6d844357
ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c
[ Upstream commit 97f3c0a4b0579b646b6b10ae5a3d59f0441cc12c ]
I found an ACPI cache leak in ACPI early termination and boot continuing case.
When early termination occurs due to malicious ACPI table, Linux kernel
terminates ACPI function and continues to boot process. While kernel terminates
ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak.
Boot log of ACPI operand cache leak is as follows:
>[ 0.464168] ACPI: Added _OSI(Module Device)
>[ 0.467022] ACPI: Added _OSI(Processor Device)
>[ 0.469376] ACPI: Added _OSI(3.0 _SCP Extensions)
>[ 0.471647] ACPI: Added _OSI(Processor Aggregator Device)
>[ 0.477997] ACPI Error: Null stack entry at ffff880215c0aad8 (20170303/exresop-174)
>[ 0.482706] ACPI Exception: AE_AML_INTERNAL, While resolving operands for [opcode_name unavailable] (20170303/dswexec-461)
>[ 0.487503] ACPI Error: Method parse/execution failed [\DBG] (Node ffff88021710ab40), AE_AML_INTERNAL (20170303/psparse-543)
>[ 0.492136] ACPI Error: Method parse/execution failed [\_SB._INI] (Node ffff88021710a618), AE_AML_INTERNAL (20170303/psparse-543)
>[ 0.497683] ACPI: Interpreter enabled
>[ 0.499385] ACPI: (supports S0)
>[ 0.501151] ACPI: Using IOAPIC for interrupt routing
>[ 0.503342] ACPI Error: Null stack entry at ffff880215c0aad8 (20170303/exresop-174)
>[ 0.506522] ACPI Exception: AE_AML_INTERNAL, While resolving operands for [opcode_name unavailable] (20170303/dswexec-461)
>[ 0.510463] ACPI Error: Method parse/execution failed [\DBG] (Node ffff88021710ab40), AE_AML_INTERNAL (20170303/psparse-543)
>[ 0.514477] ACPI Error: Method parse/execution failed [\_PIC] (Node ffff88021710ab18), AE_AML_INTERNAL (20170303/psparse-543)
>[ 0.518867] ACPI Exception: AE_AML_INTERNAL, Evaluating _PIC (20170303/bus-991)
>[ 0.522384] kmem_cache_destroy Acpi-Operand: Slab cache still has objects
>[ 0.524597] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26
>[ 0.526795] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006
>[ 0.529668] Call Trace:
>[ 0.530811] ? dump_stack+0x5c/0x81
>[ 0.532240] ? kmem_cache_destroy+0x1aa/0x1c0
>[ 0.533905] ? acpi_os_delete_cache+0xa/0x10
>[ 0.535497] ? acpi_ut_delete_caches+0x3f/0x7b
>[ 0.537237] ? acpi_terminate+0xa/0x14
>[ 0.538701] ? acpi_init+0x2af/0x34f
>[ 0.540008] ? acpi_sleep_proc_init+0x27/0x27
>[ 0.541593] ? do_one_initcall+0x4e/0x1a0
>[ 0.543008] ? kernel_init_freeable+0x19e/0x21f
>[ 0.546202] ? rest_init+0x80/0x80
>[ 0.547513] ? kernel_init+0xa/0x100
>[ 0.548817] ? ret_from_fork+0x25/0x30
>[ 0.550587] vgaarb: loaded
>[ 0.551716] EDAC MC: Ver: 3.0.0
>[ 0.553744] PCI: Probing PCI hardware
>[ 0.555038] PCI host bridge to bus 0000:00
> ... Continue to boot and log is omitted ...
I analyzed this memory leak in detail and found acpi_ns_evaluate() function
only removes Info->return_object in AE_CTRL_RETURN_VALUE case. But, when errors
occur, the status value is not AE_CTRL_RETURN_VALUE, and Info->return_object is
also not null. Therefore, this causes acpi operand memory leak.
This cache leak causes a security threat because an old kernel (<= 4.9) shows
memory locations of kernel functions in stack dump. Some malicious users
could use this information to neutralize kernel ASLR.
I made a patch to fix ACPI operand cache leak.
Signed-off-by: Seunghun Han <kkamagui@gmail.com>
Signed-off-by: Erik Schmauss <erik.schmauss@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2018-05-30 07:50:45 +02:00 |
| .. |
|
acpica
|
ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c
|
2018-05-30 07:50:45 +02:00 |
|
apei
|
ACPI: APEI / ERST: Fix missing error handling in erst_reader()
|
2017-12-29 17:42:57 +01:00 |
|
arm64
|
ACPI: Add new IORT functions to support MSI domain handling
|
2016-09-12 20:32:40 +01:00 |
|
dptf
|
ACPI / platform: Add support for build-in properties
|
2016-11-10 00:30:29 +01:00 |
|
nfit
|
nfit, address-range-scrub: fix scrub in-progress reporting
|
2018-04-24 09:34:13 +02:00 |
|
pmic
|
ACPI / PMIC: xpower: Fix power_table addresses
|
2018-03-24 11:00:18 +01:00 |
|
ac.c
|
ACPI: Remove FSF mailing addresses
|
2015-07-08 02:27:32 +02:00 |
|
acpi_amba.c
|
ACPI / amba: Remove CLK_IS_ROOT
|
2016-04-27 23:42:57 +02:00 |
|
acpi_apd.c
|
Merge branch 'device-properties'
|
2016-11-11 23:23:02 +01:00 |
|
acpi_cmos_rtc.c
|
char/genrtc: x86: remove remnants of asm/rtc.h
|
2016-06-04 00:20:07 +02:00 |
|
acpi_configfs.c
|
ACPI: Rename configfs.c to acpi_configfs.c to prevent link error
|
2016-07-11 15:13:36 +02:00 |
|
acpi_dbg.c
|
ACPI / debugger: Fix regression introduced by IS_ERR_VALUE() removal
|
2016-07-05 23:02:34 +02:00 |
|
acpi_extlog.c
|
|
|
|
acpi_ipmi.c
|
ACPI: Remove FSF mailing addresses
|
2015-07-08 02:27:32 +02:00 |
|
acpi_lpat.c
|
ACPI / lpat: make it explicitly non-modular
|
2016-07-16 03:08:10 +02:00 |
|
acpi_lpss.c
|
ACPI / platform: Add support for build-in properties
|
2016-11-10 00:30:29 +01:00 |
|
acpi_memhotplug.c
|
ACPI: Remove FSF mailing addresses
|
2015-07-08 02:27:32 +02:00 |
|
acpi_pad.c
|
ACPI: acpi_pad: Fix memory leak in power saving threads
|
2018-05-30 07:50:43 +02:00 |
|
acpi_platform.c
|
ACPI: Do not create a platform_device for IOAPIC/IOxAPIC
|
2017-04-08 09:30:34 +02:00 |
|
acpi_pnp.c
|
ACPI / PNP: constify device IDs
|
2016-01-04 22:10:30 +01:00 |
|
acpi_processor.c
|
Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
|
2017-12-20 10:07:26 +01:00 |
|
acpi_video.c
|
ACPI / video: Only default only_lcd to true on Win8-ready _desktops_
|
2018-04-29 11:32:03 +02:00 |
|
acpi_watchdog.c
|
ACPI / watchdog: Fix off-by-one error at resource assignment
|
2018-03-28 18:39:22 +02:00 |
|
battery.c
|
ACPI / battery: Add sysfs representation after checking _BST
|
2016-08-31 00:35:16 +02:00 |
|
battery.h
|
|
|
|
bgrt.c
|
drivers/acpi: make bgrt driver explicitly non-modular
|
2016-03-09 23:46:07 +01:00 |
|
blacklist.c
|
ACPI / blacklist: Make Dell Latitude 3350 ethernet work
|
2017-03-22 12:43:38 +01:00 |
|
bus.c
|
Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
|
2017-12-20 10:07:26 +01:00 |
|
button.c
|
Revert "ACPI / button: Change default behavior to lid_init_state=open"
|
2017-06-07 12:07:47 +02:00 |
|
cm_sbs.c
|
ACPI: Remove FSF mailing addresses
|
2015-07-08 02:27:32 +02:00 |
|
container.c
|
ACPI: Remove FSF mailing addresses
|
2015-07-08 02:27:32 +02:00 |
|
cppc_acpi.c
|
ACPI / CPPC: set an error code on probe error path
|
2017-01-19 20:18:07 +01:00 |
|
custom_method.c
|
|
|
|
debugfs.c
|
ACPI: fix acpi_debugfs_init prototype
|
2015-08-07 02:55:18 +02:00 |
|
device_pm.c
|
ACPI / PM: Export acpi_device_fix_up_power()
|
2016-05-20 15:54:01 +02:00 |
|
device_sysfs.c
|
ACPI / bus: Leave modalias empty for devices which are not present
|
2018-02-03 17:05:36 +01:00 |
|
dock.c
|
ACPI / dock: make dock explicitly non-modular
|
2016-07-16 03:08:08 +02:00 |
|
ec.c
|
ACPI: EC: Fix debugfs_create_*() usage
|
2018-04-13 19:48:10 +02:00 |
|
ec_sys.c
|
ACPI: EC: Fix debugfs_create_*() usage
|
2018-04-13 19:48:10 +02:00 |
|
event.c
|
netlink: make nlmsg_end() and genlmsg_end() void
|
2015-01-18 01:03:45 -05:00 |
|
evged.c
|
ACPI / GED: make evged.c explicitly non-modular
|
2016-05-09 22:59:25 +02:00 |
|
fan.c
|
ACPI / fan: Fix error reading cur_state
|
2016-10-10 02:20:43 +02:00 |
|
glue.c
|
ACPI / scan: Prefer devices without _HID/_CID for _ADR matching
|
2018-01-31 12:55:52 +01:00 |
|
gsi.c
|
ACPI: Rename acpi_gsi_get_irq_type to acpi_dev_get_irq_type and export symbol
|
2016-01-01 03:20:25 +01:00 |
|
hed.c
|
ACPI: Remove FSF mailing addresses
|
2015-07-08 02:27:32 +02:00 |
|
internal.h
|
ACPI: EC: Fix debugfs_create_*() usage
|
2018-04-13 19:48:10 +02:00 |
|
ioapic.c
|
ACPI: ioapic: Clear on-stack resource before using it
|
2017-08-30 10:21:55 +02:00 |
|
Kconfig
|
TTY/Serial patches for 4.9-rc1
|
2016-10-03 20:11:49 -07:00 |
|
Makefile
|
ACPI: Fix incompatibility with mcount-based function graph tracing
|
2017-04-08 09:30:34 +02:00 |
|
numa.c
|
acpi, numa: fix pxm to online numa node associations
|
2018-03-28 18:39:22 +02:00 |
|
nvs.c
|
|
|
|
osi.c
|
ACPI / osi: Collect _OSI handling into one single file
|
2016-05-05 00:13:53 +02:00 |
|
osl.c
|
acpi_os_vprintf: Use printk_get_level() to avoid unnecessary KERN_CONT
|
2016-10-12 21:46:37 +02:00 |
|
pci_irq.c
|
ACPI / PCI: fix GIC irq model default PCI IRQ polarity
|
2016-09-10 02:50:50 +02:00 |
|
pci_link.c
|
ACPI/PCI: pci_link: Include PIRQ_PENALTY_PCI_USING for ISA IRQs
|
2016-10-24 14:18:14 +02:00 |
|
pci_mcfg.c
|
PCI/ACPI: Add generic MCFG table handling
|
2016-06-10 18:27:59 -05:00 |
|
pci_root.c
|
x86/ioapic: Support hot-removal of IOAPICs present during boot
|
2016-08-18 11:45:18 +02:00 |
|
pci_slot.c
|
ACPI / PCI: make pci_slot explicitly non-modular
|
2016-07-16 03:05:29 +02:00 |
|
power.c
|
ACPI / power: Delay turning off unused power resources after suspend
|
2018-03-24 11:00:20 +01:00 |
|
proc.c
|
ACPI: change acpi_sleep_proc_init() to return void
|
2015-09-15 03:03:15 +02:00 |
|
processor_core.c
|
Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
|
2017-12-20 10:07:26 +01:00 |
|
processor_driver.c
|
ACPI/processor: Replace racy task affinity logic
|
2018-03-24 11:00:09 +01:00 |
|
processor_idle.c
|
nmi_backtrace: generate one-line reports for idle cpus
|
2016-10-07 18:46:30 -07:00 |
|
processor_pdc.c
|
ACPI / processor: Introduce invalid_logical_cpuid()
|
2015-05-13 23:28:14 +02:00 |
|
processor_perflib.c
|
ACPI: processor_perflib: Do not send _PPC change notification if not ready
|
2018-05-30 07:50:24 +02:00 |
|
processor_thermal.c
|
ACPI: Remove FSF mailing addresses
|
2015-07-08 02:27:32 +02:00 |
|
processor_throttling.c
|
ACPI/processor: Replace racy task affinity logic
|
2018-03-24 11:00:09 +01:00 |
|
property.c
|
ACPI / property: Allow holes in reference properties
|
2016-10-11 22:44:00 +02:00 |
|
reboot.c
|
|
|
|
resource.c
|
PCI: ACPI: IA64: fix IO port generic range check
|
2016-03-22 23:07:49 +01:00 |
|
sbs.c
|
ACPI / SBS: fix inconsistent indenting inside if statement
|
2016-01-04 22:14:27 +01:00 |
|
sbshc.c
|
ACPI: sbshc: remove raw pointer from printk() message
|
2018-02-17 13:21:20 +01:00 |
|
sbshc.h
|
|
|
|
scan.c
|
ACPI / scan: Use acpi_bus_get_status() to initialize ACPI_TYPE_DEVICE devs
|
2018-05-30 07:50:24 +02:00 |
|
sleep.c
|
ACPI / power: Delay turning off unused power resources after suspend
|
2018-03-24 11:00:20 +01:00 |
|
sleep.h
|
ACPI / power: Delay turning off unused power resources after suspend
|
2018-03-24 11:00:20 +01:00 |
|
spcr.c
|
ACPI: parse SPCR and enable matching console
|
2016-09-28 17:46:46 +02:00 |
|
sysfs.c
|
ACPI / sysfs: Provide quirk mechanism to prevent GPE flooding
|
2017-04-12 12:41:18 +02:00 |
|
tables.c
|
ACPI / tables: Remove duplicated include from tables.c
|
2016-09-17 01:03:32 +02:00 |
|
thermal.c
|
thermal: Enhance thermal_zone_device_update for events
|
2016-09-27 14:35:21 +08:00 |
|
utils.c
|
nfit: make DIMM DSMs optional
|
2016-07-19 12:32:39 -07:00 |
|
video_detect.c
|
ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E
|
2018-04-24 09:34:10 +02:00 |
|
wakeup.c
|
|
|