| Message ID | 5523582.DvuYhMxLoT@kreacher (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Bjorn Helgaas |
| Headers | show |
| Series | PCI: ACPI: Check parent pointer in acpi_pci_find_companion() | expand |
On Fri, Oct 1, 2021 at 3:58 PM Rafael J. Wysocki <rjw@rjwysocki.net> wrote: > > From: Rafael J. Wysocki <rafael.j.wysocki@intel.com> > > If acpi_pci_find_companion() is called for a device whose parent > pointer is NULL, it will crash when attempting to get the ACPI > companion of the parent due to a NULL pointer dereference in > the ACPI_COMPANION() macro. > > This was not a problem before commit 375553a93201 ("PCI: Setup ACPI > fwnode early and at the same time with OF") that made pci_setup_device() > call pci_set_acpi_fwnode() and so it allowed devices with NULL parent > pointers to be passed to acpi_pci_find_companion() which is the case > in pci_iov_add_virtfn(), for instance. > > Fix this issue by making acpi_pci_find_companion() check the device's > parent pointer upfront and bail out if it is NULL. > > While pci_iov_add_virtfn() can be changed to set the device's parent > pointer before calling pci_setup_device() for it, checking pointers > against NULL before dereferencing them is prudent anyway and looking > for ACPI companions of virtual functions isn't really useful. > > Fixes: 375553a93201 ("PCI: Setup ACPI fwnode early and at the same time with OF") > Link: https://lore.kernel.org/linux-acpi/8e4bbd5c59de31db71f718556654c0aa077df03d.camel@linux.ibm.com/ > Reported-by: Niklas Schnelle <schnelle@linux.ibm.com> > Tested-by: Niklas Schnelle <schnelle@linux.ibm.com> > Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Due to the lack of negative feedback I'm queuing this up for 5.15-rc5. If there are concerns, please let me know. > --- > drivers/pci/pci-acpi.c | 3 +++ > 1 file changed, 3 insertions(+) > > Index: linux-pm/drivers/pci/pci-acpi.c > =================================================================== > --- linux-pm.orig/drivers/pci/pci-acpi.c > +++ linux-pm/drivers/pci/pci-acpi.c > @@ -1243,6 +1243,9 @@ static struct acpi_device *acpi_pci_find > bool check_children; > u64 addr; > > + if (!dev->parent) > + return NULL; > + > down_read(&pci_acpi_companion_lookup_sem); > > adev = pci_acpi_find_companion_hook ? > > >
On Fri, Oct 01, 2021 at 03:58:10PM +0200, Rafael J. Wysocki wrote: > From: Rafael J. Wysocki <rafael.j.wysocki@intel.com> > > If acpi_pci_find_companion() is called for a device whose parent > pointer is NULL, it will crash when attempting to get the ACPI > companion of the parent due to a NULL pointer dereference in > the ACPI_COMPANION() macro. > > This was not a problem before commit 375553a93201 ("PCI: Setup ACPI > fwnode early and at the same time with OF") that made pci_setup_device() > call pci_set_acpi_fwnode() and so it allowed devices with NULL parent > pointers to be passed to acpi_pci_find_companion() which is the case > in pci_iov_add_virtfn(), for instance. > > Fix this issue by making acpi_pci_find_companion() check the device's > parent pointer upfront and bail out if it is NULL. > > While pci_iov_add_virtfn() can be changed to set the device's parent > pointer before calling pci_setup_device() for it, checking pointers > against NULL before dereferencing them is prudent anyway and looking > for ACPI companions of virtual functions isn't really useful. > > Fixes: 375553a93201 ("PCI: Setup ACPI fwnode early and at the same time with OF") > Link: https://lore.kernel.org/linux-acpi/8e4bbd5c59de31db71f718556654c0aa077df03d.camel@linux.ibm.com/ > Reported-by: Niklas Schnelle <schnelle@linux.ibm.com> > Tested-by: Niklas Schnelle <schnelle@linux.ibm.com> > Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Bjorn Helgaas <bhelgaas@google.com> > --- > drivers/pci/pci-acpi.c | 3 +++ > 1 file changed, 3 insertions(+) > > Index: linux-pm/drivers/pci/pci-acpi.c > =================================================================== > --- linux-pm.orig/drivers/pci/pci-acpi.c > +++ linux-pm/drivers/pci/pci-acpi.c > @@ -1243,6 +1243,9 @@ static struct acpi_device *acpi_pci_find > bool check_children; > u64 addr; > > + if (!dev->parent) > + return NULL; > + > down_read(&pci_acpi_companion_lookup_sem); > > adev = pci_acpi_find_companion_hook ? > > >
Index: linux-pm/drivers/pci/pci-acpi.c =================================================================== --- linux-pm.orig/drivers/pci/pci-acpi.c +++ linux-pm/drivers/pci/pci-acpi.c @@ -1243,6 +1243,9 @@ static struct acpi_device *acpi_pci_find bool check_children; u64 addr; + if (!dev->parent) + return NULL; + down_read(&pci_acpi_companion_lookup_sem); adev = pci_acpi_find_companion_hook ?