linux-kernel - Re: [PATCH v2] ACPI: processor: Fix a possible null-pointer dereference in acpi_processor_errata

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJZ5v0hEPum5414FzNC-i-oF07YSXOXavQjtUyRs6q21mCzrbQ@mail.gmail.com>
Date: Fri, 9 Jan 2026 22:19:09 +0100
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Tuo Li <islituo@...il.com>
Cc: rafael@...nel.org, lenb@...nel.org, linux-acpi@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] ACPI: processor: Fix a possible null-pointer
 dereference in acpi_processor_errata_piix4() when debug messages are enabled

On Fri, Jan 9, 2026 at 4:39 AM Tuo Li <islituo@...il.com> wrote:
>
> In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
> device and then reassigned an ISA device:
>
>   dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
>   dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
>
> If the first lookup succeeds but the second fails, dev becomes NULL. This
> leads to a potential null-pointer dereference when dev_dbg() is called:
>
>   if (errata.piix4.bmisx)
>     dev_dbg(&dev->dev, ...);
>
> To prevent this, use two temporary pointers and retrieve each device
> independently, avoiding overwriting dev with a possible NULL value.
>
>
> Signed-off-by: Tuo Li <islituo@...il.com>
> ---
> v2:
> * Add checks for ide_dev and isa_dev before dev_dbg()
>   Thanks Rafael J. Wysocki for helpful advice.
> ---
>  drivers/acpi/acpi_processor.c | 27 ++++++++++++++-------------
>  1 file changed, 14 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
> index 7ec1dc04fd11..e43978b0d83c 100644
> --- a/drivers/acpi/acpi_processor.c
> +++ b/drivers/acpi/acpi_processor.c
> @@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
>  {
>         u8 value1 = 0;
>         u8 value2 = 0;
> +       struct pci_dev *ide_dev, *isa_dev;
>
>
>         if (!dev)
> @@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
>                  * each IDE controller's DMA status to make sure we catch all
>                  * DMA activity.
>                  */
> -               dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> +               ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
>                                      PCI_DEVICE_ID_INTEL_82371AB,
>                                      PCI_ANY_ID, PCI_ANY_ID, NULL);
> -               if (dev) {
> -                       errata.piix4.bmisx = pci_resource_start(dev, 4);
> -                       pci_dev_put(dev);
> +               if (ide_dev) {
> +                       errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
> +                       pci_dev_put(ide_dev);
>                 }
>
>                 /*
> @@ -124,24 +125,24 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
>                  * disable C3 support if this is enabled, as some legacy
>                  * devices won't operate well if fast DMA is disabled.
>                  */
> -               dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> +               isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
>                                      PCI_DEVICE_ID_INTEL_82371AB_0,
>                                      PCI_ANY_ID, PCI_ANY_ID, NULL);
> -               if (dev) {
> -                       pci_read_config_byte(dev, 0x76, &value1);
> -                       pci_read_config_byte(dev, 0x77, &value2);
> +               if (isa_dev) {
> +                       pci_read_config_byte(isa_dev, 0x76, &value1);
> +                       pci_read_config_byte(isa_dev, 0x77, &value2);
>                         if ((value1 & 0x80) || (value2 & 0x80))
>                                 errata.piix4.fdma = 1;
> -                       pci_dev_put(dev);
> +                       pci_dev_put(isa_dev);
>                 }
>
>                 break;
>         }
>
> -       if (errata.piix4.bmisx)
> -               dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
> -       if (errata.piix4.fdma)
> -               dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
> +       if (errata.piix4.bmisx && ide_dev)

Why does errata.piix4.bmisx need to be checked in addition to ide_dev?
 If the latter is not NULL, the former is set, isn't it?

> +               dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
> +       if (errata.piix4.fdma && isa_dev)

And analogously here.

> +               dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
>
>         return 0;
>  }
> --

And you need to change the "break;" statement at the end of the first
"switch ()" block to "return 0;" if you don't want to initialize the
new variables to NULL.