Skip to content

Commit f132e08

Browse files
lituo1996rafaeljw
authored andcommitted
ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()
In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE device and then reassigned an ISA device: dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...); dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...); If the first lookup succeeds but the second fails, dev becomes NULL. This leads to a potential null-pointer dereference when dev_dbg() is called: if (errata.piix4.bmisx) dev_dbg(&dev->dev, ...); To prevent this, use two temporary pointers and retrieve each device independently, avoiding overwriting dev with a possible NULL value. Signed-off-by: Tuo Li <islituo@gmail.com> [ rjw: Subject adjustment, added an empty code line ] Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
1 parent 24b09e8 commit f132e08

1 file changed

Lines changed: 15 additions & 13 deletions

File tree

drivers/acpi/acpi_processor.c

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
5050
{
5151
u8 value1 = 0;
5252
u8 value2 = 0;
53+
struct pci_dev *ide_dev = NULL, *isa_dev = NULL;
5354

5455

5556
if (!dev)
@@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
107108
* each IDE controller's DMA status to make sure we catch all
108109
* DMA activity.
109110
*/
110-
dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
111+
ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
111112
PCI_DEVICE_ID_INTEL_82371AB,
112113
PCI_ANY_ID, PCI_ANY_ID, NULL);
113-
if (dev) {
114-
errata.piix4.bmisx = pci_resource_start(dev, 4);
115-
pci_dev_put(dev);
114+
if (ide_dev) {
115+
errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
116+
pci_dev_put(ide_dev);
116117
}
117118

118119
/*
@@ -124,24 +125,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
124125
* disable C3 support if this is enabled, as some legacy
125126
* devices won't operate well if fast DMA is disabled.
126127
*/
127-
dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
128+
isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
128129
PCI_DEVICE_ID_INTEL_82371AB_0,
129130
PCI_ANY_ID, PCI_ANY_ID, NULL);
130-
if (dev) {
131-
pci_read_config_byte(dev, 0x76, &value1);
132-
pci_read_config_byte(dev, 0x77, &value2);
131+
if (isa_dev) {
132+
pci_read_config_byte(isa_dev, 0x76, &value1);
133+
pci_read_config_byte(isa_dev, 0x77, &value2);
133134
if ((value1 & 0x80) || (value2 & 0x80))
134135
errata.piix4.fdma = 1;
135-
pci_dev_put(dev);
136+
pci_dev_put(isa_dev);
136137
}
137138

138139
break;
139140
}
140141

141-
if (errata.piix4.bmisx)
142-
dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
143-
if (errata.piix4.fdma)
144-
dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
142+
if (ide_dev)
143+
dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
144+
145+
if (isa_dev)
146+
dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
145147

146148
return 0;
147149
}

0 commit comments

Comments
 (0)