diff mbox series

[5.13,143/223] ACPI: fix NULL pointer dereference

Message ID	20210726153850.912570677@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Daniel Scally <djrscally@gmail.com>, Andy Shevchenko <andy.shevchenko@gmail.com>, Linus Torvalds <torvalds@linux-foundation.org>, Jens Axboe <axboe@kernel.dk> Subject: [PATCH 5.13 143/223] ACPI: fix NULL pointer dereference Date: Mon, 26 Jul 2021 17:38:55 +0200 Message-Id: <20210726153850.912570677@linuxfoundation.org> In-Reply-To: <20210726153846.245305071@linuxfoundation.org> References: <20210726153846.245305071@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.13,003/223] igc: change default return of igc_read_phy_reg() [5.13,004/223] ixgbe: Fix an error handling path in ixgbe_probe() [5.13,006/223] igb: Fix an error handling path in igb_probe() [5.13,007/223] fm10k: Fix an error handling path in fm10k_probe() [5.13,010/223] igb: Check if num of q_vectors is smaller than max before array access [5.13,013/223] gve: Fix an error handling path in gve_probe() [5.13,014/223] bpf, samples: Fix xdpsock with -M parameter missing unload process [5.13,021/223] bonding: fix suspicious RCU usage in bond_ipsec_offload_ok() [5.13,022/223] bonding: fix incorrect return value of bond_ipsec_offload_ok() [5.13,023/223] ipv6: fix disable_policy for fwd packets [5.13,024/223] stmmac: platform: Fix signedness bug in stmmac_probe_config_dt() [5.13,025/223] selftests: icmp_redirect: remove from checking for IPv6 route get [5.13,026/223] selftests: icmp_redirect: IPv6 PMTU info should be cleared after redirect [5.13,028/223] cxgb4: fix IRQ free race during driver unload [5.13,029/223] drm/vmwgfx: Fix a bad merge in otable batch takedown [5.13,030/223] mptcp: fix warning in __skb_flow_dissect() when do syn cookie for subflow join [5.13,031/223] mptcp: remove redundant req destruct in subflow_check_req() [5.13,033/223] mptcp: add sk parameter for mptcp_get_options [5.13,034/223] mptcp: avoid processing packet if a subflow reset [5.13,036/223] mptcp: use fast lock for subflows when possible [5.13,038/223] mptcp: properly account bulk freed memory [5.13,041/223] net: ocelot: fix switchdev objects synced for wrong netdev with LAG offload [5.13,042/223] sfc: fix lack of XDP TX queues - error XDP TX failed (-22) [5.13,045/223] KVM: SVM: Fix sev_pin_memory() error checks in SEV migration utilities [5.13,046/223] arm64: mte: fix restoration of GCR_EL1 from suspend [5.13,048/223] firmware: arm_scmi: Ensure drivers provide a probe function [5.13,049/223] perf inject: Fix dso->nsinfo refcounting [5.13,050/223] perf map: Fix dso->nsinfo refcounting [5.13,052/223] perf env: Fix sibling_dies memory leak [5.13,054/223] perf test event_update: Fix memory leak of evlist [5.13,056/223] perf dso: Fix memory leak in dso__new_map() [5.13,058/223] perf env: Fix memory leak of cpu_pmu_caps [5.13,059/223] perf report: Free generated help strings for sort option [5.13,065/223] perf sched: Fix record failure when CONFIG_SCHEDSTATS is not set [5.13,066/223] Kbuild: lto: fix module versionings mismatch in GNU make 3.X [5.13,068/223] spi: stm32: fixes pm_runtime calls in probe/remove [5.13,070/223] regulator: hi6421: Fix getting wrong drvdata [5.13,071/223] spi: mediatek: fix fifo rx mode [5.13,073/223] bpf, test: fix NULL pointer dereference on invalid expected_attach_type [5.13,076/223] ASoC: SOF: Intel: Update ADL descriptor to use ACPI power states [5.13,078/223] drm/vc4: hdmi: Drop devm interrupt handler for CEC interrupts [5.13,080/223] liquidio: Fix unintentional sign extension issue on left shift of u16 [5.13,082/223] bpf, sockmap: Fix potential memory leak on unlikely error case [5.13,084/223] bpf, sockmap, udp: sk_prot needs inuse_idx set for proc stats [5.13,086/223] net: fix uninit-value in caif_seqpkt_sendmsg [5.13,089/223] dma-mapping: handle vmalloc addresses in dma_common_{mmap,get_sgtable} [5.13,090/223] ASoC: soc-pcm: add a flag to reverse the stop sequence [5.13,093/223] KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM=n crash [5.13,095/223] net: sched: fix memory leak in tcindex_partial_destroy_work [5.13,097/223] netrom: Decrease sock refcount when sock timers expire [5.13,099/223] scsi: target: Fix protect handling in WRITE SAME(32) [5.13,102/223] efi/dev-path-parser: Switch to use for_each_acpi_dev_match() [5.13,103/223] ACPI: utils: Fix reference counting in for_each_acpi_dev_match() [5.13,104/223] bnxt_en: dont disable an already disabled PCI device [5.13,106/223] bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task() [5.13,108/223] bnxt_en: Validate vlan protocol ID on RX packets [5.13,110/223] net: hisilicon: rename CACHE_LINE_MASK to avoid redefinition [5.13,113/223] net: hns3: fix possible mismatches resp of mailbox [5.13,114/223] net: hns3: fix rx VLAN offload state inconsistent issue [5.13,116/223] io_uring: fix memleak in io_init_wq_offload() [5.13,119/223] ceph: dont WARN if were still opening a session to an MDS [5.13,120/223] i2c: mpc: Poll for MCF [5.13,124/223] Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem" [5.13,125/223] afs: Fix tracepoint string placement with built-in AFS [5.13,126/223] afs: check function return [5.13,128/223] r8169: Avoid duplicate sysfs entry creation error [5.13,129/223] nvme: set the PRACT bit when using Write Zeroes with T10 PI [5.13,133/223] riscv: Fix 32-bit RISC-V boot failure [5.13,134/223] tcp: disable TFO blackhole logic by default [5.13,137/223] net: sched: cls_api: Fix the the wrong parameter [5.13,140/223] cifs: only write 64kb at a time when fallocating a small region of a file [5.13,142/223] proc: Avoid mixing integer types in mem_rw() [5.13,143/223] ACPI: fix NULL pointer dereference [5.13,144/223] io_uring: Fix race condition when sqp thread goes to sleep [5.13,153/223] ALSA: pcm: Call substream ack() method upon compat mmap commit [5.13,154/223] ALSA: pcm: Fix mmap capability check [5.13,156/223] usb: xhci: avoid renesas_usb_fw.mem when its unusable [5.13,157/223] xhci: Fix lost USB 2 remote wake [5.13,160/223] KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state [5.13,162/223] usb: hub: Fix link power management max exit latency (MEL) calculations [5.13,163/223] USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS [5.13,164/223] usb: max-3421: Prevent corruption of freed memory [5.13,165/223] usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop() [5.13,166/223] USB: serial: option: add support for u-blox LARA-R6 family [5.13,169/223] usb: gadget: Fix Unbalanced pm_runtime_enable in tegra_xudc_probe [5.13,170/223] usb: dwc2: Skip clock gating on Samsung SoCs [5.13,172/223] usb: dwc2: gadget: Fix sending zero length packet in DDMA mode. [5.13,175/223] usb: typec: stusb160x: Dont block probing of consumer of "connector" nodes [5.13,176/223] firmware/efi: Tell memblock about EFI iomem reservations [5.13,177/223] tracepoints: Update static_call before tp_funcs when adding a tracepoint [5.13,178/223] tracing/histogram: Rename "cpu" to "common_cpu" [5.13,180/223] tracing: Synthetic event field_pos is an index not a boolean [5.13,181/223] btrfs: check for missing device in btrfs_trim_fs [5.13,182/223] btrfs: fix unpersisted i_size on fsync after expanding truncate [5.13,186/223] driver core: auxiliary bus: Fix memory leak when driver_register() fail [5.13,188/223] bus: mhi: core: Validate channel ID when processing command completions [5.13,189/223] bus: mhi: pci_generic: Fix inbound IPCR channel [5.13,191/223] selftest: use mmap instead of posix_memalign to allocate memory [5.13,193/223] io_uring: remove double poll entry on arm failure [5.13,196/223] kfence: move the size check to the beginning of __kfence_alloc() [5.13,198/223] mm: call flush_dcache_page() in memcpy_to_page() and memzero_page() [5.13,201/223] mm: fix the deadlock in finish_fault() [5.13,202/223] hugetlbfs: fix mount mode command line processing [5.13,204/223] rbd: always kick acquire on "acquired" and "released" notifications [5.13,205/223] misc: eeprom: at24: Always append device id even if label property is set. [5.13,208/223] Revert "drm/i915: Propagate errors on awaiting already signaled fences" [5.13,209/223] drm: Return -ENOTTY for non-drm ioctls [5.13,211/223] drm/amdgpu: update the golden setting for vangogh [5.13,214/223] bonding: fix build issue [5.13,216/223] skbuff: Release nfct refcount on napi stolen or re-used skbs [5.13,218/223] Documentation: Fix intiramfs script name [5.13,219/223] arm64: entry: fix KCOV suppression [5.13,220/223] perf inject: Close inject.output on exit [5.13,222/223] spi: spi-cadence-quadspi: Fix division by zero warning - try2 [5.13,223/223] sfc: ensure correct number of XDP queues

Commit Message

Greg KH July 26, 2021, 3:38 p.m. UTC

From: Linus Torvalds <torvalds@linux-foundation.org>

commit fc68f42aa737dc15e7665a4101d4168aadb8e4c4 upstream.

Commit 71f642833284 ("ACPI: utils: Fix reference counting in
for_each_acpi_dev_match()") started doing "acpi_dev_put()" on a pointer
that was possibly NULL.  That fails miserably, because that helper
inline function is not set up to handle that case.

Just make acpi_dev_put() silently accept a NULL pointer, rather than
calling down to put_device() with an invalid offset off that NULL
pointer.

Link: https://lore.kernel.org/lkml/a607c149-6bf6-0fd0-0e31-100378504da2@kernel.dk/
Reported-and-tested-by: Jens Axboe <axboe@kernel.dk>
Tested-by: Daniel Scally <djrscally@gmail.com>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/acpi/acpi_bus.h |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff mbox series

Patch

--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -711,7 +711,8 @@  static inline struct acpi_device *acpi_d
 
 static inline void acpi_dev_put(struct acpi_device *adev)
 {
-	put_device(&adev->dev);
+	if (adev)
+		put_device(&adev->dev);
 }
 #else	/* CONFIG_ACPI */