linux-kernel - Re: [PATCH] ACPI: processor: Fix a possible null-pointer dereference in acpi_processor_errata

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CADm8TemG+gjPTscQfV5vXQjYVk0-q5WaoetmZbifJzyOhv4UHg@mail.gmail.com>
Date: Thu, 8 Jan 2026 21:32:28 +0800
From: Tuo Li <islituo@...il.com>
To: "Rafael J. Wysocki" <rafael@...nel.org>
Cc: lenb@...nel.org, linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ACPI: processor: Fix a possible null-pointer dereference
 in acpi_processor_errata_piix4() when debug messages are enabled

On Thu, Jan 8, 2026 at 3:46 AM Rafael J. Wysocki <rafael@...nel.org> wrote:
>
> On Tue, Dec 9, 2025 at 11:31 AM Tuo Li <islituo@...il.com> wrote:
> >
> > In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
> > device and then reassigned an ISA device:
> >
> >   dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
> >   dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
> >
> > If the first lookup succeeds but the second fails, dev becomes NULL. This
> > leads to a potential null-pointer dereference when dev_dbg() is called:
> >
> >   if (errata.piix4.bmisx)
> >     dev_dbg(&dev->dev, ...);
> >
> > To prevent this, use two temporary pointers and retrieve each device
> > independently, avoiding overwriting dev with a possible NULL value.
> >
> > Signed-off-by: Tuo Li <islituo@...il.com>
> > ---
> >  drivers/acpi/acpi_processor.c | 23 ++++++++++++-----------
> >  1 file changed, 12 insertions(+), 11 deletions(-)
> >
> > diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
> > index 7ec1dc04fd11..ddd7081430f7 100644
> > --- a/drivers/acpi/acpi_processor.c
> > +++ b/drivers/acpi/acpi_processor.c
> > @@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> >  {
> >         u8 value1 = 0;
> >         u8 value2 = 0;
> > +       struct pci_dev *ide_dev, *isa_dev;
> >
> >
> >         if (!dev)
> > @@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> >                  * each IDE controller's DMA status to make sure we catch all
> >                  * DMA activity.
> >                  */
> > -               dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> > +               ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> >                                      PCI_DEVICE_ID_INTEL_82371AB,
> >                                      PCI_ANY_ID, PCI_ANY_ID, NULL);
> > -               if (dev) {
> > -                       errata.piix4.bmisx = pci_resource_start(dev, 4);
> > -                       pci_dev_put(dev);
> > +               if (ide_dev) {
> > +                       errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
> > +                       pci_dev_put(ide_dev);
> >                 }
> >
> >                 /*
> > @@ -124,24 +125,24 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> >                  * disable C3 support if this is enabled, as some legacy
> >                  * devices won't operate well if fast DMA is disabled.
> >                  */
> > -               dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> > +               isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> >                                      PCI_DEVICE_ID_INTEL_82371AB_0,
> >                                      PCI_ANY_ID, PCI_ANY_ID, NULL);
> > -               if (dev) {
> > -                       pci_read_config_byte(dev, 0x76, &value1);
> > -                       pci_read_config_byte(dev, 0x77, &value2);
> > +               if (isa_dev) {
> > +                       pci_read_config_byte(isa_dev, 0x76, &value1);
> > +                       pci_read_config_byte(isa_dev, 0x77, &value2);
> >                         if ((value1 & 0x80) || (value2 & 0x80))
> >                                 errata.piix4.fdma = 1;
> > -                       pci_dev_put(dev);
> > +                       pci_dev_put(isa_dev);
> >                 }
> >
> >                 break;
> >         }
> >
> >         if (errata.piix4.bmisx)
>
> if (ide_dev)
>
> > -               dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
> > +               dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
> >         if (errata.piix4.fdma)
>
> if (isa_dev)
>
> > -               dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
> > +               dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
> >
> >         return 0;
> >  }
> > --

Thanks for your reply.

I will add the suggested checks for ide_dev and isa_dev before dev_dbg()
and submit a v2 patch shortly.

Best regards,
Tuo