Unchecked AcpiEvaluateObject return causes NULL-pointer-dereference panic reachable from unprivileged user via CTLFLAG_ANYBODY sysctl
Summary
acpi_panasonic_sinf() and acpi_panasonic_hkey_event() call AcpiEvaluateObject() and immediately dereference result buffer pointer without checking ACPI status or testing pointer for NULL. When AcpiEvaluateObject fails (memory pressure AE_NO_MEMORY in ACPI_ALLOCATE_BUFFER kmalloc AML interpreter error missing/typed-wrong return object namespace teardown) ACPICA leaves ReturnBuffer->Pointer as caller-supplied NULL so res->Type dereferences NULL kernel panics. Four hotkey sysctls registered CTLFLAG_ANYBODY so any unprivileged local user can drive this path by reading hw.acpi.panasonic.lcd_brightness. Most realistic trigger: memory exhaustion via fork/allocation bomb forces AE_NO_MEMORY in ACPI buffer alloc. Impact: reliable full DoS system halt/reboot.
No comments yet.