linux-kernel - Re: NULL ptr deref in acpi_idle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1a6a7711-f312-406e-a3a4-da1ab5cddb32@huawei.com>
Date: Tue, 9 Dec 2025 14:59:16 +0800
From: "lihuisong (C)" <lihuisong@...wei.com>
To: Borislav Petkov <bp@...en8.de>
CC: x86-ml <x86@...nel.org>, lkml <linux-kernel@...r.kernel.org>, "Rafael J.
 Wysocki" <rafael@...nel.org>, <lihuisong@...wei.com>,
	<AmandeepKaur.Longia@....com>, Jonathan Cameron <Jonathan.Cameron@...wei.com>
Subject: Re: NULL ptr deref in acpi_idle_enter+0x46/0x100

Hello Borisla,

Thank you for report this issue.

I try to analyze the reason of this NULL pointer dereference in link [1].
I guess that the root cause of this issue is that max_cstate isn't 
initialized by acpi_processor_cstate_first_run_checks()
before setup cpuidle states in acpi_processor_register_idle_driver().

My analysis is as follows:
The "max_cstate" is ACPI_PROCESSOR_MAX_POWER(8) by default.
The acpi_processor_setup_cstates() use this value to initialize the 
cstates and state_count in acpi_idle_driver.
And I guess the state_count here is more than 1 on your paltform.
Then cpuidle core and cpuidle governor would use the cstates and 
state_count in acpi_idle_driver to select which idle state to enter.

However, from the the log you provided in link[1], the "max_cstate" on 
your platform is limited to 1 which is done in acpi_processor_power_init().
Then the index of 'acpi_cstate' in per_cpu more than one would not be 
initialized due to the updated max_cstate(1) in 
acpi_processor_setup_cpuidle_cx().
As a result, the cx for index > 1 is NULL in acpi_idle_enter().

Could you help me test and verify the analysis above using the 
modifications below on kernel without revert any ACPI idle patch?
-->

diff --git a/drivers/acpi/processor_driver.c 
b/drivers/acpi/processor_driver.c
index 5d824435b26b..554dcb5b41f0 100644

--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -258,12 +258,11 @@ static int __init acpi_processor_driver_init(void)
                 acpi_processor_ignore_ppc_init();
         }

+       acpi_processor_register_idle_driver();
         result = driver_register(&acpi_processor_driver);
         if (result < 0)
                 return result;

-       acpi_processor_register_idle_driver();
-
         result = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN,
                                    "acpi/cpu-drv:online",
                                    acpi_soft_cpu_online, NULL);
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 8d3122a4e6d0..2aeb3a71cad4 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1391,6 +1391,7 @@ void acpi_processor_register_idle_driver(void)
                 if (!pr)
                         continue;

+               acpi_processor_cstate_first_run_checks();
                 ret = acpi_processor_get_power_info(pr);
                 if (!ret) {
                         pr->flags.power_setup_done = 1;

-->
Note that the location change of acpi_processor_register_idle_driver() 
in acpi_processor_driver_init() is just to resolve the issue that
the cpuidle directory under cpuX does not exist on kernel without the 
code in link [2].

[1] 
https://lore.kernel.org/lkml/20251124200019.GIaSS5U9HhsWBotrQZ@fat_crate.local/
[2] https://lore.kernel.org/all/20240529133446.28446-2- 
Jonathan.Cameron@...wei.com/

在 2025/11/25 15:55, Borislav Petkov 写道:
> On Mon, Nov 24, 2025 at 09:00:19PM +0100, Borislav Petkov wrote:
>> Hey,
>>
>> I'm seeing this on one of my old test boxes here with -rc7 + the whole tip
>> lineup.
> Yap, you were right about
>
>    7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration")
>
> having the potential of breaking something.
>
> Reverting it fixes the issue on my machine.
>
> Here's my revert log:
>
> 53f15ee83632 (HEAD -> refs/heads/rc7+) Revert "ACPI: processor: idle: Optimize ACPI idle driver registration"
> 8a2b68f3cfb5 Revert "ACPI: processor: idle: Add module import namespace"
> 8f6f9d389700 Revert "ACPI: processor: idle: Eliminate static variable flat_state_cnt"
> 09ccf5c5a51c Revert "ACPI: processor: idle: Redefine two functions as void"
> 509d71463c8c Revert "ACPI: processor: Do not expose global variable acpi_idle_driver"
> fbd0b9c0ba44 mawk fix
> 03d9f45bc0fd Merge remote-tracking branch 'tip/objtool/core' into rc7+
> 785b41beb928 Merge remote-tracking branch 'tip/master' into rc7+
> 94d77cb7e8ec Merge remote-tracking branch 'ras/edac-for-next' into rc7+
> ...
>
> Thx.
>