Your message dated Fri, 16 Oct 2026 03:34:29 +0000
with message-id <[email protected]>
and subject line Bug#1148364: fixed in linux 7.3~rc7-1~exp1
has caused the Debian Bug report #1148364,
regarding riscv64: strnlen() returns a truncated length for very large count,
breaking ACPI name resolution (AE_AML_NAME_NOT_FOUND flood at boot)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148364: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148364
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: linux-image-7.1.13+deb14-riscv64
Version: 7.1.13-1
Severity: important
Tags: upstream
X-Debbugs-Cc: [email protected]
Dear maintainers,
arch/riscv/lib/strnlen.S has an integer-overflow bug: for a very large
`count` (in practice `(size_t)-1`) the address computation `s + count`
wraps around 2^64, the loop bound becomes smaller than the start address,
and strnlen() returns a length derived only from the first machine word
(typically 8). The same wrap exists in the byte-loop fallback.
This silently breaks any call site that the compiler lowers to
`strnlen(p, SIZE_MAX)`, which GCC does when expanding strlen()/strcat()
(or their fortified forms). The most visible victim is ACPICA:
drivers/acpi/acpica/exnames.c, acpi_ex_name_segment():
strcat(name_string, char_buf);
is compiled to `memcpy(dest + strnlen(dest, SIZE_MAX), src, ...)`. As soon
as an accumulating ACPI name exceeds 8 characters, each following 4-byte
NameSeg is written at offset 8 and clobbers the previous segment.
Observed on a SpacemiT K1 / v100 (riscv64, rv64gc + Zbb) running
7.1.13+deb14-riscv64. During early boot, from ~9 s to ~38 s after boot,
hundreds of ACPI errors are logged. Two distinct name-resolution failures
repeat: one per PCI root port (\_SB.PCxx.RP0.PCID._STA) and one for the
generic-event devices (\_SB.GHP0/_SB.GHP1._CRS).
Representative error chains (timestamps kept; addresses shown because
no_hash_pointers was enabled for capture — a plain boot prints
(____ptrval____) instead):
[ 9.200960] ACPI Warning: Invalid character(s) in name (0x00000054)
ffffbb810477b50b, repaired: [T___] (20251212/utstring-171)
[ 9.200975] ACPI Warning: Invalid character(s) in name (0x00000000)
ffffbb810477b510, repaired: [____] (20251212/utstring-171)
[ 9.200992] Failure resolving symbol [\_SB.PSTA.T._],
AE_AML_NAME_NOT_FOUND (20251212/dsutils-548)
[ 9.201045] ACPI Error: Aborting method \_SB.PC00.RP0.PCID._STA due to
previous error (AE_AML_NAME_NOT_FOUND) (20251212/psparse-529)
[ 9.227771] Method execution failed \_SB.PC00.RP0.PCID._STA due to
previous error (AE_AML_NAME_NOT_FOUND) (20251212/uteval-68)
[ 22.031086] ACPI Warning: Invalid character(s) in name (0x00000042)
ffffbb8105fc65db, repaired: [B___] (20251212/utstring-171)
[ 22.031103] Failure resolving symbol [\_SB.SGS.B],
AE_AML_NAME_NOT_FOUND (20251212/dsutils-548)
[ 22.031149] ACPI Error: Aborting method \_SB.GHP0._CRS due to previous
error (AE_AML_NAME_NOT_FOUND) (20251212/psparse-529)
[ 22.095501] Method execution failed \_SB.GHP0._CRS due to previous
error (AE_AML_NAME_NOT_FOUND) (20251212/uteval-68)
These lines repeat for each of the 16 PCI root ports that have an RP0
(PC00-PC05, PC0A-PC0F, PC10-PC14) and for GHP0/GHP1. Counts from one
capture (ACPICA debug enabled, counts are timing-dependent; a plain boot
shows the same pattern, roughly 300 "Failure resolving symbol" lines):
Failure resolving symbol [\_SB.PSTA.T._] 285
Failure resolving symbol [\_SB.SGS.B] 14
Invalid character(s) in name (0x00000054) 285 ('T')
Invalid character(s) in name (0x00000000) 285 (NUL)
Invalid character(s) in name (0x00000042) 14 ('B')
Aborting method \_SB.PC00/01/.../14.RP0.PCID._STA (26/26/25/25/25/12...)
Aborting method \_SB.GHP0._CRS 7
Aborting method \_SB.GHP1._CRS 7
The reference in the platform SSDT `\_SB.PC00.RP0.STAT` is built as
`\_SB.PSTAT` (hence the corrupted log name `\_SB.PSTA.T._`), and
`\_SB.SMSI._GSB` as `\_SB.SGS.B`, so acpi_ns_lookup() fails on the second
name segment. The same firmware + ACPI tables work fine on Ubuntu 7.0.0
and with userspace acpiexec, so the tables and ACPICA logic are correct.
REPRODUCTION
On the running kernel, a module that calls the exported strnlen() directly:
static size_t (*p_strnlen)(const char *, size_t);
static char big[64]; /* 63 x 'A' + NUL, @ 0xffffffff067fb010 */
p_strnlen(big, 1000); /* -> 63 correct */
p_strnlen(big, 1UL << 32); /* -> 8 WRONG (expected 63) */
p_strnlen(big, 1UL << 60); /* -> 8 WRONG */
p_strnlen(big, (size_t)-1); /* -> 8 WRONG */
The measured threshold matches the wrap model exactly: with
s = 0xffffffff067fb010, the first overflowing count is 2^64 - s =
0xf9804ff0 (~4.19e9); 2^32 = 0x100000000 just exceeds it, 1000 does not.
Calling the running kernel's acpi_ex_get_name_string() with the exact AML
bytes from the SSDT reproduces the corruption (status=AE_OK, full length):
input 5c 2f 04 _SB_ PC00 RP0_ STAT 0a -> \/\x04_SB_PSTAT (len 19)
input 5c 2f 03 _SB_ SMSI _GSB 0a -> \/\x03_SB_S_GSB (len 15)
CAUSE
arch/riscv/lib/strnlen.S:
/* Aligned boundary. Use the address of the last valid byte
* (s + count - 1) to avoid loading a word past the count
* boundary in the loop below. count == 0 is handled above.
*/
add t4, a0, a1 # wraps for huge count
addi t4, t4, -1
andi t4, t4, -SZREG
...
bgeu t0, t4, 2f # bails out with first-word-only result
and the byte-loop fallback:
add t2, a0, a1 # wraps for huge count
The "last valid byte" optimization did not guard against the address
wrap.
Thanks,
This message and any attachment are confidential and may be privileged or
otherwise protected from disclosure. If you are not an intended recipient of
this message, please delete it and any attachment from your system and notify
the sender immediately by reply e-mail. Unintended recipients should not use,
copy, disclose or take any action based on this message or any information
contained in this message. Emails cannot be guaranteed to be secure or error
free as they can be intercepted, amended, lost or destroyed, and you should
take full responsibility for security checking.
本邮件及其任何附件具有保密性质，并可能受其他保护或不允许被披露给第三方。如阁下误收到本邮件，敬请立即以回复电子邮件的方式通知发件人，并将本邮件及其任何附件从阁下系统中予以删除。如阁下并非本邮件写明之收件人，敬请切勿使用、复制、披露本邮件或其任何内容，亦请切勿依本邮件或其任何内容而采取任何行动。电子邮件无法保证是一种安全和不会出现任何差错的通信方式，可能会被拦截、修改、丢失或损坏，收件人需自行负责做好安全检查。
--- End Message ---
--- Begin Message ---
Source: linux
Source-Version: 7.3~rc7-1~exp1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
linux, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated linux package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 16 Oct 2026 04:51:48 +0200
Source: linux
Architecture: source
Version: 7.3~rc7-1~exp1
Distribution: experimental
Urgency: medium
Maintainer: Debian Kernel Team <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1148364 1149564 1149840 1150677
Changes:
linux (7.3~rc7-1~exp1) experimental; urgency=medium
.
* New upstream release candidate.
- bnxt_en: fix DMA mapping length for padded small packets
(Closes: #1149564)
- riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
(Closes: #1148364)
.
[ Salvatore Bonaccorso ]
* drivers/hwmon: Enable SENSORS_ARCTIC_FAN_CONTROLLER as module
(Closes: #1149840)
* Change CRYPTO_SHA512 from module to built-in, as required by IMA
(Closes: #1150677)
Checksums-Sha1:
943670ca7abe2d423d70f196aa82709d0c239a29 180429 linux_7.3~rc7-1~exp1.dsc
06a651adf41b1ebf4fb6226296890023a876044c 165730924 linux_7.3~rc7.orig.tar.xz
34b655852b6bd35170dc89ac489ed2d72068efcd 1457708
linux_7.3~rc7-1~exp1.debian.tar.xz
46c600e45d8dcfb131e4f06ac4f795a271b80778 5925
linux_7.3~rc7-1~exp1_source.buildinfo
Checksums-Sha256:
8a806f5233f53f783999343d648e288af0ea37845c0bf61bd9e7f3e18465474b 180429
linux_7.3~rc7-1~exp1.dsc
b002bfc898de459a40f47f216393f5489427ab2e4dd095b1ed510ace0a42f9f0 165730924
linux_7.3~rc7.orig.tar.xz
f6bc8ab6213a40bd624b02d0a493449c1d2c327dbea1ef01863ad9e95bf0f30c 1457708
linux_7.3~rc7-1~exp1.debian.tar.xz
5b3176154fff07790e0390be622d25bfcd61c7cd1dc386464f3218be4ee4b14c 5925
linux_7.3~rc7-1~exp1_source.buildinfo
Files:
620c7e6773f3ce71c3053573ce45bae4 180429 kernel optional
linux_7.3~rc7-1~exp1.dsc
df638a7abe9f4e77c147bcad6038322a 165730924 kernel optional
linux_7.3~rc7.orig.tar.xz
9b4ba411c608da86083e8c4c6c99fdf4 1457708 kernel optional
linux_7.3~rc7-1~exp1.debian.tar.xz
9c45ee193ed103a452b2204f87ba5abc 5925 kernel optional
linux_7.3~rc7-1~exp1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrRlslfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EChEP/iGWQM0am1AGCzCrLOZycZYBFEZVv9C7
BLVMWalwmvDCEQlzDY+IfenMMU5WPKouZPS2Iy6dm4BPWFbRB51gh30Gn4DaEr21
7ToWV6O7XufPWVh8BfdMUKgo82VcCN2UlyigjrZmTAhYVJKF6q91B8daKkkjKySV
efCX1tVAreP8pvtbDVTx1o0pQa2lTyPGTAE+fMI2be+Qz6qo2LzQWX5wd4dRZN2m
EYYQjvBeJY8Xrmt45u2gk3dUM1q0RdlLZh2RJOxvxuKx3Ogo0fo3GJyez1BvIb3y
YtJyVh2RO/JZC1sILdk6al3/76Fs2ixqwndt02Mp1+YCCwemKcW3Jlfqd1jPonB2
brwm5JR3XDWsdBq6Gs7ZsOJpd63AGzgoZYioViRyf6h8Io2iZuuOBydtQafMPRTI
G/ftOVl5aGSYqkWSbHiBFiGDyQeIGDs9nPV3gX1utdCdCKS82/Arp7H7tRQSlt0p
0xzbrCLlnxMxpg4Nlww6/cXGG6p1xSTrTc8kUELWtBm5jBuv9/YGtWrg/cM9lQ2W
33KBl/3kzRJPGyJtTi0fIGcycpcVlX/HxDV/SgjvzE8P6Mn7D6Yom0tKAv8EJKjc
ikUubGcKQyEgA3UE07oAsyUjs/iter5qztmJV7mm2pbOzllQdYAnNDlkskkTUwIM
njWrcnth2L5g
=Eyi+
-----END PGP SIGNATURE-----
pgpDJNLMEsnwK.pgp
Description: PGP signature
--- End Message ---
