Dead obj==NULL checks give false impression of bounds safety across all package helpers
Summary
All four package-extraction helpers (acpi_PkgInt:48-49 acpi_PkgStr:76-77 acpi_PkgGas:109-110 acpi_PkgRawGas:123-124) compute obj=&res->Package.Elements[idx] then test if(obj==NULL). Address-of-array-element expression can never be NULL regardless of idx so check is dead code. Actual risks (idx OOB read past Elements allocation and NULL Pointer fields inside union) not caught. Today every in-tree caller bounds-checks via ACPI_PKG_VALID (acpivar.h:491-493) so no current exploitable OOB but helpers advertise safety guarantee they do not provide. Future caller omitting ACPI_PKG_VALID silently introduces OOB read with no in-helper backstop.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2178 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | file | 759 B | ↓ raw | |
| build.sh | file | 161 B | view raw | |
| fix.diff | file | 166 B | view raw | |
| run.sh | file | 80 B | view raw |
DF-2178 - Verification Verdict
Status: reproduced (source-confirmed) Impact: none Confidence: likely
Verdict
Source-confirmed: acpi_PkgInt/Str/Gas/RawGas (:48-49,76-77,109-110,123-124) compute obj=&array[idx] then test obj==NULL; address-of-array is never NULL; dead check; real issue is idx OOB; ACPI-gated
Fix Status
Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)
Source File
Fix Validation
All 87 fix.diffs compiled together in a single batch kernel build
(make -j6 nativekernel KERNCONF=X86_64_GENERIC) with rc=0 and -Werror (0 compiler errors).
The combined patch is at findings/poc/batch_build/all_fixes.patch.
Fix verification
fixedbatch build rc=0
batch build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
acpi_Pkg obj==NULL dead check; ACPI-gated
Verified recommended fix
acpi_Pkg obj==NULL dead check; ACPI-gated
Verdict
acpi_Pkg obj==NULL dead check; ACPI-gated
No comments yet.