[PATCH] x86/PCI: Fix Null pointer dereference after call to pcie_find_root_port()

[PATCH] x86/PCI: Fix Null pointer dereference after call to pcie_find_root_port()

[Samasth Norway Ananda]

If pcie_find_root_port() is unable to locate a root port, it will return
NULL. This NULL pointer needs to be handled before trying to dereference.

Fixes: 7d08f21f8c63 ("x86/PCI: Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4")
Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
---
 arch/x86/pci/fixup.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
index b33afb240601..98a9bb92d75c 100644
--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c
@@ -980,7 +980,7 @@ static void amd_rp_pme_suspend(struct pci_dev *dev)
 		return;
 
 	rp = pcie_find_root_port(dev);
-	if (!rp->pm_cap)
+	if (!rp || !rp->pm_cap)
 		return;
 
 	rp->pme_support &= ~((PCI_PM_CAP_PME_D3hot|PCI_PM_CAP_PME_D3cold) >>
@@ -994,7 +994,7 @@ static void amd_rp_pme_resume(struct pci_dev *dev)
 	u16 pmc;
 
 	rp = pcie_find_root_port(dev);
-	if (!rp->pm_cap)
+	if (!rp || !rp->pm_cap)
 		return;
 
 	pci_read_config_word(rp, rp->pm_cap + PCI_PM_PMC, &pmc);
-- 
2.45.2

Re: [PATCH] x86/PCI: Fix Null pointer dereference after call to pcie_find_root_port()

[Bjorn Helgaas]

[+cc Mario, 7d08f21f8c63 author]

On Mon, Aug 12, 2024 at 01:26:59PM -0700, Samasth Norway Ananda wrote:
> If pcie_find_root_port() is unable to locate a root port, it will return
> NULL. This NULL pointer needs to be handled before trying to dereference.
> 
> Fixes: 7d08f21f8c63 ("x86/PCI: Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4")
> Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
> ---
>  arch/x86/pci/fixup.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
> index b33afb240601..98a9bb92d75c 100644
> --- a/arch/x86/pci/fixup.c
> +++ b/arch/x86/pci/fixup.c
> @@ -980,7 +980,7 @@ static void amd_rp_pme_suspend(struct pci_dev *dev)
>  		return;
>  
>  	rp = pcie_find_root_port(dev);
> -	if (!rp->pm_cap)
> +	if (!rp || !rp->pm_cap)

Seems reasonable.  I suspect we haven't seen problems because these
quirks are limited to Device IDs that are all PCIe, but I think we
should check on principle and because it may be copied elsewhere where
it *does* matter.

>  		return;
>  
>  	rp->pme_support &= ~((PCI_PM_CAP_PME_D3hot|PCI_PM_CAP_PME_D3cold) >>
> @@ -994,7 +994,7 @@ static void amd_rp_pme_resume(struct pci_dev *dev)
>  	u16 pmc;
>  
>  	rp = pcie_find_root_port(dev);
> -	if (!rp->pm_cap)
> +	if (!rp || !rp->pm_cap)
>  		return;
>  
>  	pci_read_config_word(rp, rp->pm_cap + PCI_PM_PMC, &pmc);
> -- 
> 2.45.2
> 

Re: [PATCH] x86/PCI: Fix Null pointer dereference after call to pcie_find_root_port()

[Mario Limonciello]

On 8/12/2024 15:51, Bjorn Helgaas wrote:
> [+cc Mario, 7d08f21f8c63 author]
> 
> On Mon, Aug 12, 2024 at 01:26:59PM -0700, Samasth Norway Ananda wrote:
>> If pcie_find_root_port() is unable to locate a root port, it will return
>> NULL. This NULL pointer needs to be handled before trying to dereference.
>>
>> Fixes: 7d08f21f8c63 ("x86/PCI: Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4")
>> Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
>> ---
>>   arch/x86/pci/fixup.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
>> index b33afb240601..98a9bb92d75c 100644
>> --- a/arch/x86/pci/fixup.c
>> +++ b/arch/x86/pci/fixup.c
>> @@ -980,7 +980,7 @@ static void amd_rp_pme_suspend(struct pci_dev *dev)
>>   		return;
>>   
>>   	rp = pcie_find_root_port(dev);
>> -	if (!rp->pm_cap)
>> +	if (!rp || !rp->pm_cap)
> 
> Seems reasonable.  I suspect we haven't seen problems because these
> quirks are limited to Device IDs that are all PCIe, but I think we
> should check on principle and because it may be copied elsewhere where
> it *does* matter.

Yeah totally agree, if nothing else it prevents copy/paste mistakes.

HOWEVER I don't think this needs to be a "Fixes" tag because there is no 
problem in THIS code on the applicable systems.  Those PCI devices are 
always attached to a root port.  So Bjorn I would suggest stripping the 
Fixes tag when committing.

Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>

> 
>>   		return;
>>   
>>   	rp->pme_support &= ~((PCI_PM_CAP_PME_D3hot|PCI_PM_CAP_PME_D3cold) >>
>> @@ -994,7 +994,7 @@ static void amd_rp_pme_resume(struct pci_dev *dev)
>>   	u16 pmc;
>>   
>>   	rp = pcie_find_root_port(dev);
>> -	if (!rp->pm_cap)
>> +	if (!rp || !rp->pm_cap)
>>   		return;
>>   
>>   	pci_read_config_word(rp, rp->pm_cap + PCI_PM_PMC, &pmc);
>> -- 
>> 2.45.2
>>

Re: [PATCH] x86/PCI: Fix Null pointer dereference after call to pcie_find_root_port()

[Bjorn Helgaas]

On Mon, Aug 12, 2024 at 01:26:59PM -0700, Samasth Norway Ananda wrote:
> If pcie_find_root_port() is unable to locate a root port, it will return
> NULL. This NULL pointer needs to be handled before trying to dereference.
> 
> Fixes: 7d08f21f8c63 ("x86/PCI: Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4")
> Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>

Applied with Mario's Reviewed-by to pci/misc for v6.12, thank you!

> ---
>  arch/x86/pci/fixup.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
> index b33afb240601..98a9bb92d75c 100644
> --- a/arch/x86/pci/fixup.c
> +++ b/arch/x86/pci/fixup.c
> @@ -980,7 +980,7 @@ static void amd_rp_pme_suspend(struct pci_dev *dev)
>  		return;
>  
>  	rp = pcie_find_root_port(dev);
> -	if (!rp->pm_cap)
> +	if (!rp || !rp->pm_cap)
>  		return;
>  
>  	rp->pme_support &= ~((PCI_PM_CAP_PME_D3hot|PCI_PM_CAP_PME_D3cold) >>
> @@ -994,7 +994,7 @@ static void amd_rp_pme_resume(struct pci_dev *dev)
>  	u16 pmc;
>  
>  	rp = pcie_find_root_port(dev);
> -	if (!rp->pm_cap)
> +	if (!rp || !rp->pm_cap)
>  		return;
>  
>  	pci_read_config_word(rp, rp->pm_cap + PCI_PM_PMC, &pmc);
> -- 
> 2.45.2
>