linux-kernel - Re: [PATCH v3 11/12] ACPI: video: convert to acpi_get_pci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 26 Jun 2009 07:43:14 +0100 (BST)
From:	Troy Moure <twmoure@...pr.net>
To:	Alex Chiang <achiang@...com>
cc:	Alex Riesen <raa.lkml@...il.com>, lenb@...nel.org,
	twmoure@...pr.net, alessandro.suardi@...il.com,
	linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org,
	Thomas Renninger <trenn@...e.de>, linux-pci@...r.kernel.org
Subject: Re: [PATCH v3 11/12] ACPI: video: convert to acpi_get_pci_dev


> Troy, I applied your S-o-B, but maybe that was not a good
> assumption on my part? To be sure, could you please respond with
> your S-o-B?
[...]
> From: Troy Moure <twmoure@...pr.net>
> 
> ACPI: prevent NULL deref in acpi_get_pci_dev()
> 
[...]
> ---
> diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
> index 8a5bf3b..55b5b90 100644
> --- a/drivers/acpi/pci_root.c
> +++ b/drivers/acpi/pci_root.c
> @@ -395,7 +395,7 @@ struct pci_dev *acpi_get_pci_dev(acpi_handle handle)
>  		fn  = adr & 0xffff;
> 
>  		pdev = pci_get_slot(pbus, PCI_DEVFN(dev, fn));
> -		if (hnd == handle)
> +		if (!pdev || hnd == handle)
>  			break;
> 
>  		pbus = pdev->subordinate;
> 
Sure, for the record,
Signed-off-by: Troy Moure <twmoure@...pr.net>

I also tried out your debug patch on my machine, which was hitting the 
problem (it's an Acer Aspire 5100).  I put a small patchlet on top of it, 
to get the names out right (see below).  The dmesg and lspci output are 
attached.

If you'd like me to do anything else, just let me know.

Regards,
-- Troy

diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 7674987..9e37e62 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -367,7 +367,7 @@ struct pci_dev *acpi_get_pci_dev(acpi_handle handle)
 	printk("Starting root bridge search from %s\n", (char *)buffer.pointer);
 	kfree(buffer.pointer);
 	buffer.pointer = NULL;
-	buffer.length = 0;
+	buffer.length = ACPI_ALLOCATE_BUFFER;
 
 	while (!acpi_is_root_bridge(phandle)) {
 		node = kzalloc(sizeof(struct acpi_handle_node), GFP_KERNEL);
@@ -382,7 +382,7 @@ struct pci_dev *acpi_get_pci_dev(acpi_handle handle)
 		printk("+ Adding %s\n", (char *)buffer.pointer);
 		kfree(buffer.pointer);
 		buffer.pointer = NULL;
-		buffer.length = 0;
+		buffer.length = ACPI_ALLOCATE_BUFFER;
 
 		status = acpi_get_parent(phandle, &phandle);
 		if (ACPI_FAILURE(status))
View attachment "lscpi-acpidebug" of type "TEXT/PLAIN" (8538 bytes)

View attachment "dmesg-acpidebug" of type "TEXT/PLAIN" (55898 bytes)