linux-kernel - Re: [PATCH 1/2] ACPI: x86: s2idle: Fix a NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 28 Sep 2022 21:36:56 +0200
From:   "Rafael J. Wysocki" <rafael@...nel.org>
To:     Mario Limonciello <mario.limonciello@....com>
Cc:     Philipp Zabel <philipp.zabel@...il.com>,
        "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
        "Luke D. Jones" <luke@...nes.dev>,
        Shyam Sundar S K <Shyam-sundar.S-k@....com>,
        Richard Gong <Richard.Gong@....com>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        Len Brown <lenb@...nel.org>,
        ACPI Devel Maling List <linux-acpi@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/2] ACPI: x86: s2idle: Fix a NULL pointer dereference

On Wed, Sep 28, 2022 at 6:19 PM Mario Limonciello
<mario.limonciello@....com> wrote:
>
> Ryzen 7000 (Raphael) introduced AMDI0008 for _HID.  This ID was added
> in commit ed470febf837 ("ACPI: PM: s2idle: Add support for upcoming AMD
> uPEP HID AMDI008"), but then removed in favor of aligning all new IDs
> to Rembrandt support in commit fd894f05cf30 ("ACPI: x86: s2idle: If a
> new AMD _HID is missing assume Rembrandt").
>
> Unfortunately there was a mistake in commit 100a57379380 ("ACPI: x86:
> s2idle: Move _HID handling for AMD systems into structures") that can
> lead to a NULL pointer dereference accessing `dev_id->driver_data` in
> the sentinel of `amd_hid_ids`.  Fix this dereference.
>
> Reported-by: Richard Gong <Richard.Gong@....com>
> Fixes: 100a57379380 ("ACPI: x86: s2idle: Move _HID handling for AMD systems into structures")
> Signed-off-by: Mario Limonciello <mario.limonciello@....com>
> ---
>  drivers/acpi/x86/s2idle.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c
> index eedd21d8a284..3ae2ba74de92 100644
> --- a/drivers/acpi/x86/s2idle.c
> +++ b/drivers/acpi/x86/s2idle.c
> @@ -470,7 +470,7 @@ static int lps0_device_attach(struct acpi_device *adev,
>                 for (dev_id = &amd_hid_ids[0]; dev_id->id[0]; dev_id++)
>                         if (acpi_dev_hid_uid_match(adev, dev_id->id, NULL))
>                                 break;
> -               if (dev_id)
> +               if (dev_id->id[0])
>                         data = (const struct amd_lps0_hid_device_data *) dev_id->driver_data;
>                 else
>                         data = &amd_rembrandt;
> --

Applied along with the [2/2], thanks!