linux-kernel - Re: [PATCH] ACPI / PCI: Fix NULL pointer dereference in acpi_get_pci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20091014224106.GF22797@ldl.fc.hp.com>
Date:	Wed, 14 Oct 2009 16:41:06 -0600
From:	Alex Chiang <achiang@...com>
To:	"Rafael J. Wysocki" <rjw@...k.pl>
Cc:	Len Brown <lenb@...nel.org>,
	Jesse Barnes <jbarnes@...tuousgeek.org>,
	linux-pm@...ts.linux-foundation.org, chepioq@...il.com,
	Linux PCI <linux-pci@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	ACPI Devel Maling List <linux-acpi@...r.kernel.org>,
	Danny Feng <dfeng@...hat.com>
Subject: Re: [PATCH] ACPI / PCI: Fix NULL pointer dereference in
	acpi_get_pci_dev() (rev. 2)

* Rafael J. Wysocki <rjw@...k.pl>:
> From: Rafael J. Wysocki <rjw@...k.pl>
> 
> acpi_get_pci_dev() may be called for a non-PCI device, in which case
> it should return NULL.  However, it assumes that every handle it
> finds in the ACPI CA name space, between given device handle and the
> PCI root bridge handle, corresponds to a PCI-to-PCI bridge with an
> existing secondary bus.  For this reason, when it finds a struct
> pci_dev object corresponding to one of them, it doesn't check if
> its 'subordinate' field is a valid pointer.  This obviously leads to
> a NULL pointer dereference if acpi_get_pci_dev() is called for a
> non-PCI device with a PCI parent which is not a bridge.
> 
> To fix this issue make acpi_get_pci_dev() check if pdev->subordinate
> is not NULL for every device it finds on the path between the root
> bridge and the device it's supposed to get to and return NULL if the
> "target" device cannot be found.
> 
> Fixes http://bugzilla.kernel.org/show_bug.cgi?id=14129, which is a
> regression from 2.6.30.
 
Acked-by: Alex Chiang <achiang@...com>

> Signed-off-by: Rafael J. Wysocki <rjw@...k.pl>
> ---
> 
> Jesse, Len,
> 
> This is a replacement for the original $subject patch (now in the Len's tree
> as commit 5988eaded02e3cca2702f46efc255143468255bd).
> 
> The code was correct, but the comment and the changelog were not.  Please
> use the one below instead.
> 
> Thanks,
> Rafael
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/