255862 2021-05-14 09:18:13 +0000 [PATCH] dev/acpica: Fix a double free in acpi_pci_link_route_irqs 2021-06-02 13:39:08 +0000 1 1 1 Unclassified Base System kern CURRENT Any Any Closed FIXED --- Affects Many People --- 1 lylgood markj markj oldest_to_newest 1161277 0 224925 lylgood 2021-05-14 09:18:13 +0000 Created attachment 224925 add a status check Bug File: sys/dev/acpica/acpi_pci_link.c In function acpi_pci_link_route_irqs, srsbuf->Pointer is freed via AcpiOsFree() in the callee status = acpi_pci_link_srs_from_links(sc, &srsbuf), and then the callee returns a FAILURE status. But the returned status has not been checked, that causes srsbuf->Pointer is freed again at line 916 and 876, which are double free bugs. My patch adds a check on the returned status of acpi_pci_link_srs_from_links() to avoid the double free. 1163226 1 commit-hook 2021-05-26 14:50:15 +0000 A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=4cf33275289088e3b0a913a44b5cd549e348094d commit 4cf33275289088e3b0a913a44b5cd549e348094d Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2021-05-26 14:34:39 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2021-05-26 14:49:30 +0000 acpi: Add missing error handling to acpi_pci_link_route_irqs() Otherwise the resouce buffer may have been freed when AcpiSetCurrentResources() is called, leading to a use-after-free. PR: 255862 Submitted by: Lv Yunlong <lylgood@foxmail.com> (original version) MFC after: 1 week sys/dev/acpica/acpi_pci_link.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) 1164418 2 commit-hook 2021-06-02 13:35:45 +0000 A commit in branch stable/13 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=78b147467ea55886071b099d364757e827afbcd7 commit 78b147467ea55886071b099d364757e827afbcd7 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2021-05-26 14:34:39 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2021-06-02 13:32:37 +0000 acpi: Add missing error handling to acpi_pci_link_route_irqs() Otherwise the resouce buffer may have been freed when AcpiSetCurrentResources() is called, leading to a use-after-free. PR: 255862 Submitted by: Lv Yunlong <lylgood@foxmail.com> (original version) MFC after: 1 week (cherry picked from commit 4cf33275289088e3b0a913a44b5cd549e348094d) sys/dev/acpica/acpi_pci_link.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) 1164423 3 commit-hook 2021-06-02 13:37:49 +0000 A commit in branch stable/12 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=a53f3a29bf6d3af7cbddaf97b04b05cac7e923a6 commit a53f3a29bf6d3af7cbddaf97b04b05cac7e923a6 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2021-05-26 14:34:39 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2021-06-02 13:36:03 +0000 acpi: Add missing error handling to acpi_pci_link_route_irqs() Otherwise the resouce buffer may have been freed when AcpiSetCurrentResources() is called, leading to a use-after-free. PR: 255862 Submitted by: Lv Yunlong <lylgood@foxmail.com> (original version) MFC after: 1 week (cherry picked from commit 4cf33275289088e3b0a913a44b5cd549e348094d) sys/dev/acpica/acpi_pci_link.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) 224925 2021-05-14 09:18:13 +0000 2021-05-14 09:18:13 +0000 add a status check 0001-dev-acpica-double-free-acpi_pci_link.patch text/plain 508 lylgood ZGlmZiAtLWdpdCBhL3N5cy9kZXYvYWNwaWNhL2FjcGlfcGNpX2xpbmsuYyBiL3N5cy9kZXYvYWNw aWNhL2FjcGlfcGNpX2xpbmsuYwppbmRleCBlY2M0ZjI2ZDNmYjQuLjExOGQxODlmM2IzNyAxMDA2 NDQKLS0tIGEvc3lzL2Rldi9hY3BpY2EvYWNwaV9wY2lfbGluay5jCisrKyBiL3N5cy9kZXYvYWNw aWNhL2FjcGlfcGNpX2xpbmsuYwpAQCAtODY4LDYgKzg2OCwxMCBAQCBhY3BpX3BjaV9saW5rX3Jv dXRlX2lycXMoZGV2aWNlX3QgZGV2KQogCWVsc2UKIAkJc3RhdHVzID0gYWNwaV9wY2lfbGlua19z cnNfZnJvbV9jcnMoc2MsICZzcnNidWYpOwogCisJaWYgKEFDUElfRkFJTFVSRShzdGF0dXMpKSB7 CisJCXJldHVybiAoc3RhdHVzKTsKKwl9CisKIAkvKiBXcml0ZSBvdXQgbmV3IHJlc291cmNlcyB2 aWEgX1NSUy4gKi8KIAlzdGF0dXMgPSBBY3BpU2V0Q3VycmVudFJlc291cmNlcyhhY3BpX2dldF9o YW5kbGUoZGV2KSwgJnNyc2J1Zik7CiAJaWYgKEFDUElfRkFJTFVSRShzdGF0dXMpKSB7Cg==