linux-kernel - Re: [PATCH] ACPI: APEI: Avoid NULL pointer dereference in ghes_estatus_pool_region

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJZ5v0i4ds3Cjc5x+Umx2m57ebf4w_MOf1saE=iEFrqsv5ZrQA@mail.gmail.com>
Date: Tue, 3 Feb 2026 13:56:41 +0100
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Jiawen Wu <jiawenwu@...stnetic.com>
Cc: "Rafael J. Wysocki" <rafael@...nel.org>, Tony Luck <tony.luck@...el.com>, 
	Borislav Petkov <bp@...en8.de>, Hanjun Guo <guohanjun@...wei.com>, 
	Mauro Carvalho Chehab <mchehab@...nel.org>, Shuai Xue <xueshuai@...ux.alibaba.com>, 
	Len Brown <lenb@...nel.org>, Shiju Jose <shiju.jose@...wei.com>, 
	Bjorn Helgaas <bhelgaas@...gle.com>, linux-acpi@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ACPI: APEI: Avoid NULL pointer dereference in ghes_estatus_pool_region_free

On Tue, Feb 3, 2026 at 3:14 AM Jiawen Wu <jiawenwu@...stnetic.com> wrote:
>
> The function ghes_estatus_pool_region_free() is exported and be called
> by the PCIe AER recovery path, which unconditionally invokes it to free
> aer_capability_regs memory.
>
> Although current AER usage assumes memory comes from the GHES pool,
> robustness requires guarding against pool unavailability. Add a NULL check
> before calling gen_pool_free() to prevent crashes when the pool is not
> initialized. This also makes the API safer for potential future use by
> non-GHES callers.

Are any such callers going to be added any time soon?

> Fixes: e2abc47a5a1a ("ACPI: APEI: Fix AER info corruption when error status data has multiple sections")

It doesn't fix anything, the lack of the check is not an error
currently, AFAICS.

> Signed-off-by: Jiawen Wu <jiawenwu@...stnetic.com>
> ---
>  drivers/acpi/apei/ghes.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
> index 0dc767392a6c..e81c007464a9 100644
> --- a/drivers/acpi/apei/ghes.c
> +++ b/drivers/acpi/apei/ghes.c
> @@ -236,7 +236,8 @@ int ghes_estatus_pool_init(unsigned int num_ghes)
>   */
>  void ghes_estatus_pool_region_free(unsigned long addr, u32 size)
>  {
> -       gen_pool_free(ghes_estatus_pool, addr, size);
> +       if (ghes_estatus_pool)
> +               gen_pool_free(ghes_estatus_pool, addr, size);
>  }
>  EXPORT_SYMBOL_GPL(ghes_estatus_pool_region_free);
>
> --