drivers/acpi/acpi_processor.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
device and then reassigned an ISA device:
dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
If the first lookup succeeds but the second fails, dev becomes NULL. This
leads to a potential null-pointer dereference when dev_dbg() is called:
if (errata.piix4.bmisx)
dev_dbg(&dev->dev, ...);
To prevent this, use two temporary pointers and retrieve each device
independently, avoiding overwriting dev with a possible NULL value.
Signed-off-by: Tuo Li <islituo@gmail.com>
---
v2:
* Add checks for ide_dev and isa_dev before dev_dbg()
Thanks Rafael J. Wysocki for helpful advice.
---
drivers/acpi/acpi_processor.c | 27 ++++++++++++++-------------
1 file changed, 14 insertions(+), 13 deletions(-)
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index 7ec1dc04fd11..e43978b0d83c 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
{
u8 value1 = 0;
u8 value2 = 0;
+ struct pci_dev *ide_dev, *isa_dev;
if (!dev)
@@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
* each IDE controller's DMA status to make sure we catch all
* DMA activity.
*/
- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
PCI_DEVICE_ID_INTEL_82371AB,
PCI_ANY_ID, PCI_ANY_ID, NULL);
- if (dev) {
- errata.piix4.bmisx = pci_resource_start(dev, 4);
- pci_dev_put(dev);
+ if (ide_dev) {
+ errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
+ pci_dev_put(ide_dev);
}
/*
@@ -124,24 +125,24 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
* disable C3 support if this is enabled, as some legacy
* devices won't operate well if fast DMA is disabled.
*/
- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
PCI_DEVICE_ID_INTEL_82371AB_0,
PCI_ANY_ID, PCI_ANY_ID, NULL);
- if (dev) {
- pci_read_config_byte(dev, 0x76, &value1);
- pci_read_config_byte(dev, 0x77, &value2);
+ if (isa_dev) {
+ pci_read_config_byte(isa_dev, 0x76, &value1);
+ pci_read_config_byte(isa_dev, 0x77, &value2);
if ((value1 & 0x80) || (value2 & 0x80))
errata.piix4.fdma = 1;
- pci_dev_put(dev);
+ pci_dev_put(isa_dev);
}
break;
}
- if (errata.piix4.bmisx)
- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
- if (errata.piix4.fdma)
- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
+ if (errata.piix4.bmisx && ide_dev)
+ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
+ if (errata.piix4.fdma && isa_dev)
+ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
return 0;
}
--
2.43.0On Fri, Jan 9, 2026 at 4:39 AM Tuo Li <islituo@gmail.com> wrote:
>
> In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
> device and then reassigned an ISA device:
>
> dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
> dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
>
> If the first lookup succeeds but the second fails, dev becomes NULL. This
> leads to a potential null-pointer dereference when dev_dbg() is called:
>
> if (errata.piix4.bmisx)
> dev_dbg(&dev->dev, ...);
>
> To prevent this, use two temporary pointers and retrieve each device
> independently, avoiding overwriting dev with a possible NULL value.
>
>
> Signed-off-by: Tuo Li <islituo@gmail.com>
> ---
> v2:
> * Add checks for ide_dev and isa_dev before dev_dbg()
> Thanks Rafael J. Wysocki for helpful advice.
> ---
> drivers/acpi/acpi_processor.c | 27 ++++++++++++++-------------
> 1 file changed, 14 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
> index 7ec1dc04fd11..e43978b0d83c 100644
> --- a/drivers/acpi/acpi_processor.c
> +++ b/drivers/acpi/acpi_processor.c
> @@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> {
> u8 value1 = 0;
> u8 value2 = 0;
> + struct pci_dev *ide_dev, *isa_dev;
>
>
> if (!dev)
> @@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> * each IDE controller's DMA status to make sure we catch all
> * DMA activity.
> */
> - dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> + ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> PCI_DEVICE_ID_INTEL_82371AB,
> PCI_ANY_ID, PCI_ANY_ID, NULL);
> - if (dev) {
> - errata.piix4.bmisx = pci_resource_start(dev, 4);
> - pci_dev_put(dev);
> + if (ide_dev) {
> + errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
> + pci_dev_put(ide_dev);
> }
>
> /*
> @@ -124,24 +125,24 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> * disable C3 support if this is enabled, as some legacy
> * devices won't operate well if fast DMA is disabled.
> */
> - dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> + isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> PCI_DEVICE_ID_INTEL_82371AB_0,
> PCI_ANY_ID, PCI_ANY_ID, NULL);
> - if (dev) {
> - pci_read_config_byte(dev, 0x76, &value1);
> - pci_read_config_byte(dev, 0x77, &value2);
> + if (isa_dev) {
> + pci_read_config_byte(isa_dev, 0x76, &value1);
> + pci_read_config_byte(isa_dev, 0x77, &value2);
> if ((value1 & 0x80) || (value2 & 0x80))
> errata.piix4.fdma = 1;
> - pci_dev_put(dev);
> + pci_dev_put(isa_dev);
> }
>
> break;
> }
>
> - if (errata.piix4.bmisx)
> - dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
> - if (errata.piix4.fdma)
> - dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
> + if (errata.piix4.bmisx && ide_dev)
Why does errata.piix4.bmisx need to be checked in addition to ide_dev?
If the latter is not NULL, the former is set, isn't it?
> + dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
> + if (errata.piix4.fdma && isa_dev)
And analogously here.
> + dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
>
> return 0;
> }
> --
And you need to change the "break;" statement at the end of the first
"switch ()" block to "return 0;" if you don't want to initialize the
new variables to NULL.
Hi Rafael,
Thank you for the careful review.
On Sat, Jan 10, 2026 at 5:19 AM Rafael J. Wysocki <rafael@kernel.org> wrote:
>
> On Fri, Jan 9, 2026 at 4:39 AM Tuo Li <islituo@gmail.com> wrote:
> >
> > In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
> > device and then reassigned an ISA device:
> >
> > dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
> > dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
> >
> > If the first lookup succeeds but the second fails, dev becomes NULL. This
> > leads to a potential null-pointer dereference when dev_dbg() is called:
> >
> > if (errata.piix4.bmisx)
> > dev_dbg(&dev->dev, ...);
> >
> > To prevent this, use two temporary pointers and retrieve each device
> > independently, avoiding overwriting dev with a possible NULL value.
> >
> >
> > Signed-off-by: Tuo Li <islituo@gmail.com>
> > ---
> > v2:
> > * Add checks for ide_dev and isa_dev before dev_dbg()
> > Thanks Rafael J. Wysocki for helpful advice.
> > ---
> > drivers/acpi/acpi_processor.c | 27 ++++++++++++++-------------
> > 1 file changed, 14 insertions(+), 13 deletions(-)
> >
> > diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
> > index 7ec1dc04fd11..e43978b0d83c 100644
> > --- a/drivers/acpi/acpi_processor.c
> > +++ b/drivers/acpi/acpi_processor.c
> > @@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> > {
> > u8 value1 = 0;
> > u8 value2 = 0;
> > + struct pci_dev *ide_dev, *isa_dev;
> >
> >
> > if (!dev)
> > @@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> > * each IDE controller's DMA status to make sure we catch all
> > * DMA activity.
> > */
> > - dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> > + ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> > PCI_DEVICE_ID_INTEL_82371AB,
> > PCI_ANY_ID, PCI_ANY_ID, NULL);
> > - if (dev) {
> > - errata.piix4.bmisx = pci_resource_start(dev, 4);
> > - pci_dev_put(dev);
> > + if (ide_dev) {
> > + errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
> > + pci_dev_put(ide_dev);
> > }
> >
> > /*
> > @@ -124,24 +125,24 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
> > * disable C3 support if this is enabled, as some legacy
> > * devices won't operate well if fast DMA is disabled.
> > */
> > - dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> > + isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
> > PCI_DEVICE_ID_INTEL_82371AB_0,
> > PCI_ANY_ID, PCI_ANY_ID, NULL);
> > - if (dev) {
> > - pci_read_config_byte(dev, 0x76, &value1);
> > - pci_read_config_byte(dev, 0x77, &value2);
> > + if (isa_dev) {
> > + pci_read_config_byte(isa_dev, 0x76, &value1);
> > + pci_read_config_byte(isa_dev, 0x77, &value2);
> > if ((value1 & 0x80) || (value2 & 0x80))
> > errata.piix4.fdma = 1;
> > - pci_dev_put(dev);
> > + pci_dev_put(isa_dev);
> > }
> >
> > break;
> > }
> >
> > - if (errata.piix4.bmisx)
> > - dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
> > - if (errata.piix4.fdma)
> > - dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
> > + if (errata.piix4.bmisx && ide_dev)
>
> Why does errata.piix4.bmisx need to be checked in addition to ide_dev?
> If the latter is not NULL, the former is set, isn't it?
>
> > + dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
> > + if (errata.piix4.fdma && isa_dev)
>
> And analogously here.
Checking errata.piix4.bmisx (or fdma) in addition to ide_dev / isa_dev is
indeed redundant, and I will simplify the conditions accordingly.
>
> > + dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
> >
> > return 0;
> > }
> > --
>
> And you need to change the "break;" statement at the end of the first
> "switch ()" block to "return 0;" if you don't want to initialize the
> new variables to NULL.
Good catch! To avoid any risk of using uninitialized pointers, I think it
is better to initialize ide_dev and isa_dev to NULL at declaration.
I will address both points in v3.
Thanks again for the helpful feedback.
Best regards,
Tuo
© 2016 - 2026 Red Hat, Inc.