| Message ID | 20250411194820.3976363-1-chenyuan0y@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | x86/acpi: fix potential NULL deref in acpi_wakeup_cpu() | expand |
On Fri, Apr 11, 2025 at 9:48 PM Chenyuan Yang <chenyuan0y@gmail.com> wrote: > > The result of memremap() may be NULL on failure, leading to a NULL > dereference. Add explicit checks after memremap() call: if the > MADT mailbox fails to map, return immediately. > > This is similar to the commit 966d47e1f27c > ("efi: fix potential NULL deref in efi_mem_reserve_persistent"). > > This is found by our static analysis tool KNighter. > > Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com> > Fixes: 2b5e22afae07 ("x86/acpi: Extract ACPI MADT wakeup code into a separate file") Well, it's good to add the author of the commit you're trying to fix to the CC list. Kirill, what do you think about this? > --- > arch/x86/kernel/acpi/madt_wakeup.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/arch/x86/kernel/acpi/madt_wakeup.c b/arch/x86/kernel/acpi/madt_wakeup.c > index f36f28405dcc..b386ec4b87c2 100644 > --- a/arch/x86/kernel/acpi/madt_wakeup.c > +++ b/arch/x86/kernel/acpi/madt_wakeup.c > @@ -143,6 +143,10 @@ static int acpi_wakeup_cpu(u32 apicid, unsigned long start_ip) > acpi_mp_wake_mailbox = memremap(acpi_mp_wake_mailbox_paddr, > sizeof(*acpi_mp_wake_mailbox), > MEMREMAP_WB); > + if (!acpi_mp_wake_mailbox) { > + pr_err("Failed to remap MADT mailbox\n"); > + return -ENOMEM; > + } > } > > /* > -- > 2.34.1 >
diff --git a/arch/x86/kernel/acpi/madt_wakeup.c b/arch/x86/kernel/acpi/madt_wakeup.c index f36f28405dcc..b386ec4b87c2 100644 --- a/arch/x86/kernel/acpi/madt_wakeup.c +++ b/arch/x86/kernel/acpi/madt_wakeup.c @@ -143,6 +143,10 @@ static int acpi_wakeup_cpu(u32 apicid, unsigned long start_ip) acpi_mp_wake_mailbox = memremap(acpi_mp_wake_mailbox_paddr, sizeof(*acpi_mp_wake_mailbox), MEMREMAP_WB); + if (!acpi_mp_wake_mailbox) { + pr_err("Failed to remap MADT mailbox\n"); + return -ENOMEM; + } } /*
The result of memremap() may be NULL on failure, leading to a NULL dereference. Add explicit checks after memremap() call: if the MADT mailbox fails to map, return immediately. This is similar to the commit 966d47e1f27c ("efi: fix potential NULL deref in efi_mem_reserve_persistent"). This is found by our static analysis tool KNighter. Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com> Fixes: 2b5e22afae07 ("x86/acpi: Extract ACPI MADT wakeup code into a separate file") --- arch/x86/kernel/acpi/madt_wakeup.c | 4 ++++ 1 file changed, 4 insertions(+)