linux-kernel - Re: [PATCH] ACPI: processor: Fix a possible null-pointer dereference in acpi_processor_errata

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJZ5v0gG9v_S7L7S1yuUBLFSXi2GbHUees4p-VEKhVot+2omDQ@mail.gmail.com>
Date: Wed, 7 Jan 2026 20:45:47 +0100
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Tuo Li <islituo@...il.com>
Cc: rafael@...nel.org, lenb@...nel.org, linux-acpi@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ACPI: processor: Fix a possible null-pointer dereference
 in acpi_processor_errata_piix4() when debug messages are enabled

On Tue, Dec 9, 2025 at 11:31 AM Tuo Li <islituo@...il.com> wrote:
>
> In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
> device and then reassigned an ISA device:
>
>   dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
>   dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
>
> If the first lookup succeeds but the second fails, dev becomes NULL. This
> leads to a potential null-pointer dereference when dev_dbg() is called:
>
>   if (errata.piix4.bmisx)
>     dev_dbg(&dev->dev, ...);
>
> To prevent this, use two temporary pointers and retrieve each device
> independently, avoiding overwriting dev with a possible NULL value.
>
> Signed-off-by: Tuo Li <islituo@...il.com>
> ---
>  drivers/acpi/acpi_processor.c | 23 ++++++++++++-----------
>  1 file changed, 12 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
> index 7ec1dc04fd11..ddd7081430f7 100644
> --- a/drivers/acpi/acpi_processor.c
> +++ b/drivers/acpi/acpi_processor.c
> @@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
>  {
>         u8 value1 = 0;
>         u8 value2 = 0;
> +       struct pci_dev *ide_dev, *isa_dev;
>
>
>         if (!dev)
> @@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
>                  * each IDE controller's DMA status to make sure we catch all
>                  * DMA activity.
>                  */
> -               dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> +               ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
>                                      PCI_DEVICE_ID_INTEL_82371AB,
>                                      PCI_ANY_ID, PCI_ANY_ID, NULL);
> -               if (dev) {
> -                       errata.piix4.bmisx = pci_resource_start(dev, 4);
> -                       pci_dev_put(dev);
> +               if (ide_dev) {
> +                       errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
> +                       pci_dev_put(ide_dev);
>                 }
>
>                 /*
> @@ -124,24 +125,24 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
>                  * disable C3 support if this is enabled, as some legacy
>                  * devices won't operate well if fast DMA is disabled.
>                  */
> -               dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> +               isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
>                                      PCI_DEVICE_ID_INTEL_82371AB_0,
>                                      PCI_ANY_ID, PCI_ANY_ID, NULL);
> -               if (dev) {
> -                       pci_read_config_byte(dev, 0x76, &value1);
> -                       pci_read_config_byte(dev, 0x77, &value2);
> +               if (isa_dev) {
> +                       pci_read_config_byte(isa_dev, 0x76, &value1);
> +                       pci_read_config_byte(isa_dev, 0x77, &value2);
>                         if ((value1 & 0x80) || (value2 & 0x80))
>                                 errata.piix4.fdma = 1;
> -                       pci_dev_put(dev);
> +                       pci_dev_put(isa_dev);
>                 }
>
>                 break;
>         }
>
>         if (errata.piix4.bmisx)

if (ide_dev)

> -               dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
> +               dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
>         if (errata.piix4.fdma)

if (isa_dev)

> -               dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
> +               dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
>
>         return 0;
>  }
> --