linux-kernel - [PATCH 1/2] ACPI: x86: s2idle: Fix a NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220928161935.31913-1-mario.limonciello@amd.com>
Date:   Wed, 28 Sep 2022 11:19:34 -0500
From:   Mario Limonciello <mario.limonciello@....com>
To:     <mario.limonciello@....com>,
        Philipp Zabel <philipp.zabel@...il.com>,
        "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>
CC:     <luke@...nes.dev>, <Shyam-sundar.S-k@....com>,
        Richard Gong <Richard.Gong@....com>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        Len Brown <lenb@...nel.org>, <linux-acpi@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>
Subject: [PATCH 1/2] ACPI: x86: s2idle: Fix a NULL pointer dereference

Ryzen 7000 (Raphael) introduced AMDI0008 for _HID.  This ID was added
in commit ed470febf837 ("ACPI: PM: s2idle: Add support for upcoming AMD
uPEP HID AMDI008"), but then removed in favor of aligning all new IDs
to Rembrandt support in commit fd894f05cf30 ("ACPI: x86: s2idle: If a
new AMD _HID is missing assume Rembrandt").

Unfortunately there was a mistake in commit 100a57379380 ("ACPI: x86:
s2idle: Move _HID handling for AMD systems into structures") that can
lead to a NULL pointer dereference accessing `dev_id->driver_data` in
the sentinel of `amd_hid_ids`.  Fix this dereference.

Reported-by: Richard Gong <Richard.Gong@....com>
Fixes: 100a57379380 ("ACPI: x86: s2idle: Move _HID handling for AMD systems into structures")
Signed-off-by: Mario Limonciello <mario.limonciello@....com>
---
 drivers/acpi/x86/s2idle.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c
index eedd21d8a284..3ae2ba74de92 100644
--- a/drivers/acpi/x86/s2idle.c
+++ b/drivers/acpi/x86/s2idle.c
@@ -470,7 +470,7 @@ static int lps0_device_attach(struct acpi_device *adev,
 		for (dev_id = &amd_hid_ids[0]; dev_id->id[0]; dev_id++)
 			if (acpi_dev_hid_uid_match(adev, dev_id->id, NULL))
 				break;
-		if (dev_id)
+		if (dev_id->id[0])
 			data = (const struct amd_lps0_hid_device_data *) dev_id->driver_data;
 		else
 			data = &amd_rembrandt;
-- 
2.34.1