linux-kernel - Re: [PATCH v2] ACPI: processor: Fix a possible null-pointer dereference in acpi_processor_errata

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CADm8TeniUDHajFA0sb10R=m4xK-ocyFmajkf_4BzPeea72Mrow@mail.gmail.com>
Date: Sat, 10 Jan 2026 21:46:35 +0800
From: Tuo Li <islituo@...il.com>
To: "Rafael J. Wysocki" <rafael@...nel.org>
Cc: lenb@...nel.org, linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] ACPI: processor: Fix a possible null-pointer
 dereference in acpi_processor_errata_piix4() when debug messages are enabled

Hi Rafael,

Thank you for the careful review.

On Sat, Jan 10, 2026 at 5:19 AM Rafael J. Wysocki <rafael@...nel.org> wrote:
>
> On Fri, Jan 9, 2026 at 4:39 AM Tuo Li <islituo@...il.com> wrote:
> >
> > In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
> > device and then reassigned an ISA device:
> >
> >   dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
> >   dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
> >
> > If the first lookup succeeds but the second fails, dev becomes NULL. This
> > leads to a potential null-pointer dereference when dev_dbg() is called:
> >
> >   if (errata.piix4.bmisx)
> >     dev_dbg(&dev->dev, ...);
> >
> > To prevent this, use two temporary pointers and retrieve each device
> > independently, avoiding overwriting dev with a possible NULL value.
> >
> >
> > Signed-off-by: Tuo Li <islituo@...il.com>
> > ---
> > v2:
> > * Add checks for ide_dev and isa_dev before dev_dbg()
> >   Thanks Rafael J. Wysocki for helpful advice.
> > ---
> >  drivers/acpi/acpi_processor.c | 27 ++++++++++++++-------------
> >  1 file changed, 14 insertions(+), 13 deletions(-)
> >
> > diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
> > index 7ec1dc04fd11..e43978b0d83c 100644
> > --- a/drivers/acpi/acpi_processor.c
> > +++ b/drivers/acpi/acpi_processor.c
> > @@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> >  {
> >         u8 value1 = 0;
> >         u8 value2 = 0;
> > +       struct pci_dev *ide_dev, *isa_dev;
> >
> >
> >         if (!dev)
> > @@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> >                  * each IDE controller's DMA status to make sure we catch all
> >                  * DMA activity.
> >                  */
> > -               dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> > +               ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> >                                      PCI_DEVICE_ID_INTEL_82371AB,
> >                                      PCI_ANY_ID, PCI_ANY_ID, NULL);
> > -               if (dev) {
> > -                       errata.piix4.bmisx = pci_resource_start(dev, 4);
> > -                       pci_dev_put(dev);
> > +               if (ide_dev) {
> > +                       errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
> > +                       pci_dev_put(ide_dev);
> >                 }
> >
> >                 /*
> > @@ -124,24 +125,24 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> >                  * disable C3 support if this is enabled, as some legacy
> >                  * devices won't operate well if fast DMA is disabled.
> >                  */
> > -               dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> > +               isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> >                                      PCI_DEVICE_ID_INTEL_82371AB_0,
> >                                      PCI_ANY_ID, PCI_ANY_ID, NULL);
> > -               if (dev) {
> > -                       pci_read_config_byte(dev, 0x76, &value1);
> > -                       pci_read_config_byte(dev, 0x77, &value2);
> > +               if (isa_dev) {
> > +                       pci_read_config_byte(isa_dev, 0x76, &value1);
> > +                       pci_read_config_byte(isa_dev, 0x77, &value2);
> >                         if ((value1 & 0x80) || (value2 & 0x80))
> >                                 errata.piix4.fdma = 1;
> > -                       pci_dev_put(dev);
> > +                       pci_dev_put(isa_dev);
> >                 }
> >
> >                 break;
> >         }
> >
> > -       if (errata.piix4.bmisx)
> > -               dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
> > -       if (errata.piix4.fdma)
> > -               dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
> > +       if (errata.piix4.bmisx && ide_dev)
>
> Why does errata.piix4.bmisx need to be checked in addition to ide_dev?
>  If the latter is not NULL, the former is set, isn't it?
>
> > +               dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
> > +       if (errata.piix4.fdma && isa_dev)
>
> And analogously here.

Checking errata.piix4.bmisx (or fdma) in addition to ide_dev / isa_dev is
indeed redundant, and I will simplify the conditions accordingly.
>
> > +               dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
> >
> >         return 0;
> >  }
> > --
>
> And you need to change the "break;" statement at the end of the first
> "switch ()" block to "return 0;" if you don't want to initialize the
> new variables to NULL.

Good catch! To avoid any risk of using uninitialized pointers, I think it
is better to initialize ide_dev and isa_dev to NULL at declaration.

I will address both points in v3.

Thanks again for the helpful feedback.

Best regards,
Tuo