linux-kernel - RE: NULL pointer dereference in igen6_probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CY8PR11MB7134444B84D6860AFF1C85078973A@CY8PR11MB7134.namprd11.prod.outlook.com>
Date: Tue, 17 Jun 2025 16:16:41 +0000
From: "Zhuo, Qiuxu" <qiuxu.zhuo@...el.com>
To: Borislav Petkov <bp@...en8.de>
CC: "Luck, Tony" <tony.luck@...el.com>,
	Marek Marczykowski-Górecki
	<marmarek@...isiblethingslab.com>, "open list:EDAC-IGEN6"
	<linux-edac@...r.kernel.org>, open list <linux-kernel@...r.kernel.org>
Subject: RE: NULL pointer dereference in igen6_probe - 6.16-rc2

> From: Borislav Petkov <bp@...en8.de>
> [...]
> > Reverting 'cfg' in this igen6_edac driver to non-const, allowing it to
> > be set with the actual number of detected memory controllers seems
> reasonable.
> 
> Question is: is that something the driver should allow? Detecting more

In the igen6_edac driver, when notified of the memory errors, it checks all 
the memory controllers specified by 'cfg->num_imc' to identify the source 
of the error. 

Either checking if imc->window == NULL (indicating null MMIO for absent 
memory controllers) before each usage point, or updating 'cfg->num_imc' to
reflect the real present memory controllers should fix the issue.  The latter
one is simpler.

> memory controllers but enabling less. How can that even happen?
> 

The maximum number of detected memory controllers is bounded
by the macro NUM_IMC [1]. This value is what we know as the maximum 
possible value now.

[1] https://github.com/torvalds/linux/blob/master/drivers/edac/igen6_edac.c#L1324

> > After that then applying Boris' fix above is the simplest way to
> > resolve the issue. 😊
> 
> Right, just prepare a proper patch, please, so that Marek can test and confirm.
> 

OK. 
I'll make a patch for Marek to test first. 
Thanks Boris.

- Qiuxu