[PATCH 5.10/5.15/6.1/6.6/6.12] agp/amd64: Fix broken error propagation in agp_amd64_probe()

[PATCH 5.10/5.15/6.1/6.6/6.12] agp/amd64: Fix broken error propagation in agp_amd64_probe()

[Alexander Martyniuk]

From: Mingyu Wang <25181214217@stu.xidian.edu.cn>

commit b08472db93b1ccff84a7adec5779d47f0e9d3a30 upstream.

A NULL pointer dereference was observed in the AMD64 AGP driver when
running in a virtualized environment (e.g. qemu/kvm) without a physical
AMD northbridge. The crash occurs in amd64_fetch_size() when attempting
to dereference the pointer returned by node_to_amd_nb(0).

The root cause of this crash is broken error propagation in
agp_amd64_probe(): When no AMD northbridges are found, cache_nbs()
correctly returns -ENODEV. However, the probe function erroneously
checks the return value against exactly -1, rather than < 0.

As a result, the hardware absence error is masked, allowing the driver
to improperly proceed with initialization. It eventually calls
agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware
does not exist, node_to_amd_nb(0) returns NULL, leading to a General
Protection Fault (GPF) when accessing its ->misc member.

Fix the issue by correcting the error check in agp_amd64_probe() to
abort properly when cache_nbs() returns any negative error code. This
prevents the driver from erroneously proceeding without hardware, thereby
avoiding the subsequent NULL pointer dereference at its source.

Fixes: a32073bffc65 ("[PATCH] x86_64: Clean and enhance up K8 northbridge access code")
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v2.6.18+
Link: https://patch.msgid.link/20260504074823.99377-1-w15303746062@163.com
Signed-off-by: Alexander Martyniuk <alexevgmart@gmail.com>
---
 drivers/char/agp/amd64-agp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 8e41731d3642..c9d7cefa5192 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -546,7 +546,7 @@ static int agp_amd64_probe(struct pci_dev *pdev,
 	/* Fill in the mode register */
 	pci_read_config_dword(pdev, bridge->capndx+PCI_AGP_STATUS, &bridge->mode);
 
-	if (cache_nbs(pdev, cap_ptr) == -1) {
+	if (cache_nbs(pdev, cap_ptr) < 0) {
 		agp_put_bridge(bridge);
 		return -ENODEV;
 	}
-- 
2.43.0

Re: [PATCH 5.10/5.15/6.1/6.6/6.12] agp/amd64: Fix broken error propagation in agp_amd64_probe()

[Andi Kleen]

On Mon, Jun 29, 2026 at 01:21:23PM +0300, Alexander Martyniuk wrote:
> From: Mingyu Wang <25181214217@stu.xidian.edu.cn>
> 
> commit b08472db93b1ccff84a7adec5779d47f0e9d3a30 upstream.
> 
> A NULL pointer dereference was observed in the AMD64 AGP driver when
> running in a virtualized environment (e.g. qemu/kvm) without a physical
> AMD northbridge. The crash occurs in amd64_fetch_size() when attempting
> to dereference the pointer returned by node_to_amd_nb(0).

What is special about this virtual environment? Nobody else 
seems to have seen that in 20+ years.

Or maybe the Fixes tag is not quite correct and something else more
recent has caused it.


-Andi

Re: [PATCH 5.10/5.15/6.1/6.6/6.12] agp/amd64: Fix broken error propagation in agp_amd64_probe()

[Mingyu Wang]

> What is special about this virtual environment? Nobody else
> seems to have seen that in 20+ years.
>
> Or maybe the Fixes tag is not quite correct and something else more
> recent has caused it.

Hi Andi,


You are right that normal users will not see this crash in the wild.

The environment is a QEMU-based driver fuzzing framework. Rather than 
functionally emulating specific hardware, the framework extracts device 
matching information from the driver and synthesizes a mock PCI device 
just to trigger the driver's binding and initialization paths.

In this case, the synthesized PCI device matched the AGP bridge's IDs, 
forcing `agp_amd64_probe()` to run. However, because this is a synthetic 
fuzzing environment, there was no physical or emulated AMD Northbridge 
present in the system.

In a real-world system, the AGP bridge and the Northbridge exist 
together. Because the fuzzing framework provided the mock PCI device but 
did not provide the Northbridge, `cache_nbs()` returned -ENODEV, 
exposing the flawed `== -1` error handling path.

The `Fixes` tag is correct. The logic flaw was introduced in that 
commit, but it remained dormant because standard hardware configurations 
do not produce this specific missing-hardware scenario.

Best regards,
Mingyu Wang

Re: [PATCH 5.10/5.15/6.1/6.6/6.12] agp/amd64: Fix broken error propagation in agp_amd64_probe()

[Greg Kroah-Hartman]

On Tue, Jun 30, 2026 at 09:23:50AM +0800, Mingyu Wang wrote:
> 
> > What is special about this virtual environment? Nobody else
> > seems to have seen that in 20+ years.
> > 
> > Or maybe the Fixes tag is not quite correct and something else more
> > recent has caused it.
> 
> Hi Andi,
> 
> 
> You are right that normal users will not see this crash in the wild.
> 
> The environment is a QEMU-based driver fuzzing framework. Rather than
> functionally emulating specific hardware, the framework extracts device
> matching information from the driver and synthesizes a mock PCI device just
> to trigger the driver's binding and initialization paths.
> 
> In this case, the synthesized PCI device matched the AGP bridge's IDs,
> forcing `agp_amd64_probe()` to run. However, because this is a synthetic
> fuzzing environment, there was no physical or emulated AMD Northbridge
> present in the system.

Which means this is a contrivied environment that no one will actually
use, so there is no need to backport this change anywhere.

thanks,

greg k-h