PCI: pnv_php: Fix potential NULL dereference in slot allocator

[PATCH] PCI: pnv_php: Fix potential NULL dereference in slot allocator

Posted by Timothy Pearson 2 months, 1 week ago

A highly unlikely NULL dereference in the allocation error handling path was
introduced in 466861909255.  Avoid dereferencing php_slot->bus by using
dev_warn() instead of SLOT_WARN() in the error path.

Fixes: 466861909255 ("PCI: pnv_php: Clean up allocated IRQs on unplug")
Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com>
---
 drivers/pci/hotplug/pnv_php.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c
index c5345bff9a55..f735935d80e7 100644
--- a/drivers/pci/hotplug/pnv_php.c
+++ b/drivers/pci/hotplug/pnv_php.c
@@ -804,7 +804,7 @@ static struct pnv_php_slot *pnv_php_alloc_slot(struct device_node *dn)
 	/* Allocate workqueue for this slot's interrupt handling */
 	php_slot->wq = alloc_workqueue("pciehp-%s", 0, 0, php_slot->name);
 	if (!php_slot->wq) {
-		SLOT_WARN(php_slot, "Cannot alloc workqueue\n");
+		dev_warn(&bus->dev, "Cannot alloc workqueue\n");
 		kfree(php_slot->name);
 		kfree(php_slot);
 		return NULL;
-- 
2.39.5

Re: [PATCH] PCI: pnv_php: Fix potential NULL dereference in slot allocator

Posted by Jiri Slaby 2 months, 1 week ago

On 09. 10. 25, 3:24, Timothy Pearson wrote:
> A highly unlikely NULL dereference in the allocation error handling path was
> introduced in 466861909255.  Avoid dereferencing php_slot->bus by using
> dev_warn() instead of SLOT_WARN() in the error path.
> 
> Fixes: 466861909255 ("PCI: pnv_php: Clean up allocated IRQs on unplug")
> Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com>

LGTM, perhaps also a lnk to the report:
Link: 
https://lore.kernel.org/all/304758063.1694752.1757427687463.JavaMail.zimbra@raptorengineeringinc.com/


Reviewed-by: Jiri Slaby <jirislaby@kernel.org>

thanks,
-- 
js
suse labs

Re: [PATCH] PCI: pnv_php: Fix potential NULL dereference in slot allocator

Posted by Timothy Pearson 1 month, 1 week ago


----- Original Message -----
> From: "Jiri Slaby" <jirislaby@kernel.org>
> To: "Timothy Pearson" <tpearson@raptorengineering.com>
> Cc: "linuxppc-dev" <linuxppc-dev@lists.ozlabs.org>, "linux-kernel" <linux-kernel@vger.kernel.org>, "linux-pci"
> <linux-pci@vger.kernel.org>, "Madhavan Srinivasan" <maddy@linux.ibm.com>, "Michael Ellerman" <mpe@ellerman.id.au>,
> "christophe leroy" <christophe.leroy@csgroup.eu>, "Naveen N Rao" <naveen@kernel.org>, "Bjorn Helgaas"
> <bhelgaas@google.com>, "Shawn Anastasio" <sanastasio@raptorengineering.com>
> Sent: Thursday, October 9, 2025 12:54:19 AM
> Subject: Re: [PATCH] PCI: pnv_php: Fix potential NULL dereference in slot allocator

> On 09. 10. 25, 3:24, Timothy Pearson wrote:
>> A highly unlikely NULL dereference in the allocation error handling path was
>> introduced in 466861909255.  Avoid dereferencing php_slot->bus by using
>> dev_warn() instead of SLOT_WARN() in the error path.
>> 
>> Fixes: 466861909255 ("PCI: pnv_php: Clean up allocated IRQs on unplug")
>> Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com>
> 
> LGTM, perhaps also a lnk to the report:
> Link:
> https://lore.kernel.org/all/304758063.1694752.1757427687463.JavaMail.zimbra@raptorengineeringinc.com/
> 
> 
> Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
> 
> thanks,
> --
> js
> suse labs

Just a quick follow up on this to see if we could get it merged?  Thanks!