From ec696f34774db985841bac9a2df179c0040ef073 Mon Sep 17 00:00:00 2001 From: Ivan Hu Date: Mon, 19 Oct 2026 16:54:17 +0200 Subject: [PATCH] ACPICA: Initialize parser_state.aml_end in acpi_install_method() In AcpiInstallMethod(), the local ParserState is stack-allocated and only ParserState.Aml was initialized. Parser helpers called by this path read ParserState.AmlEnd for bounds checking: AcpiPsPeekOpcode() reads it before validating the first AML opcode, and AcpiPsGetNextPackageEnd() reads it indirectly via AcpiPsGetNextPackageLength(). The subsequent package-limit check also compares against ParserState.AmlEnd. Because AmlEnd was never set, these checks operated on an uninitialized value, which Coverity flagged as an uninitialized read (CID 1684785) and which could lead to incorrect parser bounds decisions. Coverity report: *** CID 1684785: Memory - illegal accesses (UNINIT) /src/acpica/source/components/namespace/nsxfname.c: 712 in AcpiInstallMethod() ParserState.Aml += AcpiPsGetOpcodeSize (Opcode); >>> CID 1684785: Memory - illegal accesses (UNINIT) >>> Using uninitialized value "ParserState.AmlEnd" when calling "AcpiPsGetNextPackageEnd". ParserState.PkgEnd = AcpiPsGetNextPackageEnd (&ParserState); Initialize ParserState.AmlEnd to the end of the table (Buffer + Table->Length) so the parser bounds checks operate on a valid limit. Link: https://github.com/open-acpica/acpica/commit/19429ef91ebfb2144c918038dce13e297b4ef051 Fixes: bdc357540129 ("ACPICA: add boundary checks in two places") Signed-off-by: Ivan Hu Signed-off-by: Maciej Wieczor-Retman Signed-off-by: Leonard Lausen [ rjw: Subject tweaks ] Link: https://patch.msgid.link/20261019145421.47181-2-leonard@lausen.nl Signed-off-by: Rafael J. Wysocki --- drivers/acpi/acpica/nsxfname.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/acpi/acpica/nsxfname.c b/drivers/acpi/acpica/nsxfname.c index b6534187cd43..fcd94947fedb 100644 --- a/drivers/acpi/acpica/nsxfname.c +++ b/drivers/acpi/acpica/nsxfname.c @@ -503,6 +503,7 @@ acpi_status acpi_install_method(u8 *buffer) /* First AML opcode in the table must be a control method */ parser_state.aml = buffer + sizeof(struct acpi_table_header); + parser_state.aml_end = buffer + table->length; opcode = acpi_ps_peek_opcode(&parser_state); if (opcode != AML_METHOD_OP) { return (AE_BAD_PARAMETER);