From patchwork Wed Jun 19 18:56:14 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?b?UmFkaW0gS3LEjW3DocWZ?= X-Patchwork-Id: 2751651 X-Patchwork-Delegate: bhelgaas@google.com Return-Path: X-Original-To: patchwork-linux-pci@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 970C7C0AB1 for ; Wed, 19 Jun 2013 18:57:09 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 7FA1C204A7 for ; Wed, 19 Jun 2013 18:57:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5731D2049E for ; Wed, 19 Jun 2013 18:57:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757377Ab3FSS4l (ORCPT ); Wed, 19 Jun 2013 14:56:41 -0400 Received: from mx1.redhat.com ([209.132.183.28]:46031 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756847Ab3FSS4k (ORCPT ); Wed, 19 Jun 2013 14:56:40 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r5JIuYmM000392 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 19 Jun 2013 14:56:34 -0400 Received: from potion.localdomain (dhcp-1-123.brq.redhat.com [10.34.1.123]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id r5JIuXVb022505; Wed, 19 Jun 2013 14:56:34 -0400 Received: by potion.localdomain (Postfix, from userid 1000) id 7CA016689E; Wed, 19 Jun 2013 20:56:14 +0200 (CEST) From: =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= To: linux-pci@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Myron Stowe , Joe Lawrence , Kenji Kaneshige , Bjorn Helgaas , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= Subject: [PATCH] PCI: avoid NULL deref in alloc_pcie_link_state Date: Wed, 19 Jun 2013 20:56:14 +0200 Message-Id: <1371668174-32115-1-git-send-email-rkrcmar@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 Sender: linux-pci-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org X-Spam-Status: No, score=-7.2 required=5.0 tests=BAYES_00,HK_RANDOM_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP PCIe switch upstream port can be connected directly to the PCIe root bus in QEMU; ASPM does not expect this topology and dereferences NULL pointer when initializing. I have not confirmed this can happen on real hardware, but it is presented as a feature in QEMU, so there is no reason to panic if we can recover. The dereference happens with topology defined by -M q35 -device x3130-upstream,bus=pcie.0,id=upstream \ -device xio3130-downstream,bus=upstream,id=downstream,chassis=1 where on line drivers/pci/pcie/aspm.c:530 (alloc_pcie_link_state+13): parent = pdev->bus->parent->self->link_state; "pdev->bus->parent->self == NULL", because "pdev->bus->parent" has no "->parent", hence no "->self". Even though discouraged by QEMU documentation, one can set up even topology without the upstream port -M q35 -device xio3130-downstream,bus=pcie.0,id=downstream,chassis=1 so "pdev->bus->parent == NULL", because "pdev->bus" is the root bus. The patch checks for this too, because I do not like *NULL. Right now, PCIe switch has to connect to the root port -M q35 -device ioh3420,bus=pcie.0,id=root.0 \ -device x3130-upstream,bus=root.0,id=upstream \ -device xio3130-downstream,bus=upstream,id=downstream,chassis=1 Signed-off-by: Radim Kr?má? --- drivers/pci/pcie/aspm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c index 403a443..1ad1514 100644 --- a/drivers/pci/pcie/aspm.c +++ b/drivers/pci/pcie/aspm.c @@ -527,8 +527,8 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev) link->pdev = pdev; if (pci_pcie_type(pdev) == PCI_EXP_TYPE_DOWNSTREAM) { struct pcie_link_state *parent; - parent = pdev->bus->parent->self->link_state; - if (!parent) { + if (!pdev->bus->parent || !pdev->bus->parent->self || + !(parent = pdev->bus->parent->self->link_state)) { kfree(link); return NULL; }