| Message ID | 20220928161935.31913-1-mario.limonciello@amd.com (mailing list archive) |
|---|---|
| State | Mainlined, archived |
| Headers | show |
| Series | [1/2] ACPI: x86: s2idle: Fix a NULL pointer dereference | expand |
On Wed, Sep 28, 2022 at 6:19 PM Mario Limonciello <mario.limonciello@amd.com> wrote: > > Ryzen 7000 (Raphael) introduced AMDI0008 for _HID. This ID was added > in commit ed470febf837 ("ACPI: PM: s2idle: Add support for upcoming AMD > uPEP HID AMDI008"), but then removed in favor of aligning all new IDs > to Rembrandt support in commit fd894f05cf30 ("ACPI: x86: s2idle: If a > new AMD _HID is missing assume Rembrandt"). > > Unfortunately there was a mistake in commit 100a57379380 ("ACPI: x86: > s2idle: Move _HID handling for AMD systems into structures") that can > lead to a NULL pointer dereference accessing `dev_id->driver_data` in > the sentinel of `amd_hid_ids`. Fix this dereference. > > Reported-by: Richard Gong <Richard.Gong@amd.com> > Fixes: 100a57379380 ("ACPI: x86: s2idle: Move _HID handling for AMD systems into structures") > Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> > --- > drivers/acpi/x86/s2idle.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c > index eedd21d8a284..3ae2ba74de92 100644 > --- a/drivers/acpi/x86/s2idle.c > +++ b/drivers/acpi/x86/s2idle.c > @@ -470,7 +470,7 @@ static int lps0_device_attach(struct acpi_device *adev, > for (dev_id = &amd_hid_ids[0]; dev_id->id[0]; dev_id++) > if (acpi_dev_hid_uid_match(adev, dev_id->id, NULL)) > break; > - if (dev_id) > + if (dev_id->id[0]) > data = (const struct amd_lps0_hid_device_data *) dev_id->driver_data; > else > data = &amd_rembrandt; > -- Applied along with the [2/2], thanks!
diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c index eedd21d8a284..3ae2ba74de92 100644 --- a/drivers/acpi/x86/s2idle.c +++ b/drivers/acpi/x86/s2idle.c @@ -470,7 +470,7 @@ static int lps0_device_attach(struct acpi_device *adev, for (dev_id = &amd_hid_ids[0]; dev_id->id[0]; dev_id++) if (acpi_dev_hid_uid_match(adev, dev_id->id, NULL)) break; - if (dev_id) + if (dev_id->id[0]) data = (const struct amd_lps0_hid_device_data *) dev_id->driver_data; else data = &amd_rembrandt;
Ryzen 7000 (Raphael) introduced AMDI0008 for _HID. This ID was added in commit ed470febf837 ("ACPI: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008"), but then removed in favor of aligning all new IDs to Rembrandt support in commit fd894f05cf30 ("ACPI: x86: s2idle: If a new AMD _HID is missing assume Rembrandt"). Unfortunately there was a mistake in commit 100a57379380 ("ACPI: x86: s2idle: Move _HID handling for AMD systems into structures") that can lead to a NULL pointer dereference accessing `dev_id->driver_data` in the sentinel of `amd_hid_ids`. Fix this dereference. Reported-by: Richard Gong <Richard.Gong@amd.com> Fixes: 100a57379380 ("ACPI: x86: s2idle: Move _HID handling for AMD systems into structures") Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> --- drivers/acpi/x86/s2idle.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)