https://bugzilla.kernel.org/show_bug.cgi?id=221992
Bug ID: 221992
Summary: NULL pointer dereference in acpi_ps_peek_opcode()
executing an EC query method after hibernate/resume
Product: ACPI
Version: 2.5
Kernel Version: 7.1.5-76070105-generic (Pop!_OS), ACPICA 20251212
Hardware: Intel
OS: Linux
Status: NEW
Severity: high
Priority: P3
Component: ACPICA-Core
Assignee: [email protected]
Reporter: [email protected]
Regression: No
Created attachment 310823
--> https://bugzilla.kernel.org/attachment.cgi?id=310823&action=edit
EFI pstore dmesg from the crashed boot (contains the oops)
[1] Description
acpi_ps_peek_opcode() dereferences a NULL parser_state->aml while the ACPI
interpreter is executing an Embedded Controller query method from the kec_query
workqueue. The fault is immediately preceded by AE_CTRL_PENDING escaping from
acpi_ds_create_operands():
ACPI Error: AE_CTRL_PENDING, While creating Arg 1 (20251212/dsutils-732)
BUG: kernel NULL pointer dereference, address: 0000000000000000
The machine survived this oops but ACPI event handling was left degraded.
Roughly
50 minutes later a USB-C DisplayPort-alt-mode hotplug (handled via ucsi_acpi,
so
it re-enters AML execution) hard-locked the system with no further output. The
last line ever written was:
ACPI Error: No installed handler for fixed event - PowerButton (2), disabling
which is why the power button did nothing and the machine needed a forced
power-off. That message appears in no other boot on this system.
[2] Faulting instruction analysis
RIP: 0010:acpi_ps_peek_opcode+0xa/0x40
Code: ... 55 48 8b 57 08 <0f> b6 02 48 89 e5 ...
55 push rbp
48 8b 57 08 mov rdx, [rdi+8] ; parser_state->aml
0f b6 02 movzx eax, byte [rdx] ; <-- faults
RDI: ffff8f17efdf9838 (parser_state)
RDX: 0000000000000000 (parser_state->aml == NULL)
CR2: 0000000000000000
struct acpi_parse_state has aml_start at offset 0 and aml at offset 8, so the
read is parser_state->aml, and it is NULL on entry to acpi_ps_peek_opcode().
The interpreter's contract is to execute untrusted firmware bytecode, so
malformed AML should produce an AE_AML_* status and abort the method rather
than
faulting. AE_CTRL_PENDING is a control code, and its arrival at the
"While creating Arg %u" exception path in acpi_ds_create_operands() suggests
the
condition is not being handled where it is produced; the parse loop then
continues with an invalid parser_state.
[3] Full oops
ACPI Error: AE_CTRL_PENDING, While creating Arg 1 (20251212/dsutils-732)
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 13 UID: 0 PID: 18479 Comm: kworker/13:0 Tainted: G W OE
7.1.5-76070105-generic PREEMPT(lazy)
Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: ASUSTeK COMPUTER INC. ROG Zephyrus G16 GU605MZ_GU605MZ/GU605MZ,
BIOS GU605MZ.329 06/06/2025
Workqueue: kec_query acpi_ec_event_processor
RIP: 0010:acpi_ps_peek_opcode+0xa/0x40
Code: c0 83 c0 01 48 89 e5 5d 31 ff c3 cc cc cc cc 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 8b 57 08 <0f> b6 02 48 89 e5 66 83
f8 5b 74 0a 5d 31 d2 31 ff c3 cc cc cc cc
RSP: 0018:ffffd5234202bc98 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8f17efdf9800 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8f17efdf9838
RBP: ffffd5234202bce0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffd5234202bcf0 R14: ffff8f17efdf9838 R15: ffffd5234202bcf0
FS: 0000000000000000(0000) GS:ffff8f1d49c55000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000738842006 CR4: 0000000000f72ef0
PKRU: 55555554
Call Trace:
<TASK>
? acpi_ps_create_op+0x8f/0x3f0
acpi_ps_parse_loop+0x156/0x780
acpi_ps_parse_aml+0x226/0x600
acpi_ps_execute_method+0x172/0x3e0
acpi_ns_evaluate+0x175/0x5f0
acpi_evaluate_object+0x213/0x490
acpi_ec_event_processor+0xe6/0x140
process_one_work+0x1af/0x420
worker_thread+0x1bf/0x350
? __pfx_worker_thread+0x10/0x10
kthread+0xfb/0x140
? __pfx_kthread+0x10/0x10
ret_from_fork+0x1f8/0x2b0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
[4] Preceding AML failures (same boot, starting ~20 min after resume)
Repeating roughly every 40 seconds from 09:31 until the oops at 10:32:
ACPI Error: Unknown class in reference(...) - 0x00 (20251212/exoparg1-1051)
Initialized Arguments for Method [_DSM]: (4 arguments defined for method
invocation)
Arg0: Buffer(16) 01 2D 13 A3 DA 8C BA 49
Arg1: Integer 0000000000000200
Arg2: Integer 0000000000000013
Arg3: Buffer(4) 04 00 00 00
ACPI Error: Aborting method \_SB.PC00.RP12.PXSX._DSM due to previous error
(AE_TYPE) (20251212/psparse-529)
NVRM: osCallACPI_DSM: osCallACPI_DSM: Error during 0x6 DSM subfunction 0x13!
status=0x59
NVRM: _kperfSendPostPowerStateCallback: PostPState callback error:0x59
RP12.PXSX is the discrete GPU's PCIe root port. These _DSM failures appear in
NO
other boot on this machine, only in the boot that had hibernated.
[5] Sequence
08:51:19 cold boot (kernel 7.1.5, ACPICA 20251212)
09:08:59 hibernate (S4) entered
09:12:08 resume
09:31 \_SB.PC00.RP12.PXSX._DSM begins failing with AE_TYPE, repeatedly
10:32:23 the oops above (uptime 6064s), system continues running
~11:22:50 USB-C DP-alt-mode monitor hotplug -> total hard lock
11:22:54 "No installed handler for fixed event - PowerButton (2), disabling"
(last output; forced power-off required)
The oops was recovered from EFI pstore on the following boot. Ordinary journal
output for the final seconds was lost to the lockup.
[6] Reproducibility
Not yet deterministic. One captured occurrence. It requires a hibernate/resume
cycle first; the machine runs for weeks across suspend/resume with zero ACPI
errors. In the current (non-hibernated) boot the same \_SB.PC00.RP12.PXSX._DSM
call succeeds and the dGPU runtime-suspends normally, so the AML path is only
broken after S4.
[7] Environment
Kernel: 7.1.5-76070105-generic (Pop!_OS 24.04, Ubuntu noble base)
ACPICA: 20251212
Hardware: ASUSTeK ROG Zephyrus G16 GU605MZ
BIOS: GU605MZ.329, 06/06/2025 (newest ASUS has ever published for this
model; confirmed against the vendor support API, no update exists)
CPU/GPU: Intel Meteor Lake-P, Intel Arc iGPU (i915) + RTX 4080 Mobile
USB-C: ucsi_acpi / typec_ucsi, with an ASUS SSDT named "TbtTypeC"
Taint note: nvidia 580.173.02 (open kernel module), system76_acpi/system76_io
and evdi are loaded out-of-tree. None appear in the call trace, which is
entirely ACPICA plus the EC workqueue.
[8] BERT note
On the boot following the lockup, firmware had left one record in the Boot
Error
Record Table, which the kernel did not print:
ACPI: BERT 0x0000000045B3D000 000030 (v01 INTEL EDK2 00000001 INTL
00000001)
BERT: [Hardware Error]: Skipped 1 error records
BERT: Total records found: 1
Severity was below the fatal/recoverable threshold that bert_print_all() emits,
so the contents were not decoded. Happy to extract the record if that would
help.
Full EFI pstore dump, acpidump and a clean-boot dmesg attached.
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
acpi-bugzilla mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/acpi-bugzilla
