kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/pci/pcie
History
Breno Leitao 41683624cb PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() 
commit deb2f22838 upstream.

When platform firmware supplies error information to the OS, e.g., via the
ACPI APEI GHES mechanism, it may identify an error source device that
doesn't advertise an AER Capability and therefore dev->aer_info, which
contains AER stats and ratelimiting data, is NULL.

pci_dev_aer_stats_incr() already checks dev->aer_info for NULL, but
aer_ratelimit() did not, leading to NULL pointer dereferences like this one
from the URL below:

  {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 0
  {1}[Hardware Error]: event severity: corrected
  {1}[Hardware Error]:   device_id: 0000:00:00.0
  {1}[Hardware Error]:   vendor_id: 0x8086, device_id: 0x2020
  {1}[Hardware Error]:   aer_cor_status: 0x00001000, aer_cor_mask: 0x00002000
  BUG: kernel NULL pointer dereference, address: 0000000000000264
  RIP: 0010:___ratelimit+0xc/0x1b0
  pci_print_aer+0x141/0x360
  aer_recover_work_func+0xb5/0x130

[8086:2020] is an Intel "Sky Lake-E DMI3 Registers" device that claims to
be a Root Port but does not advertise an AER Capability.

Add a NULL check in aer_ratelimit() to avoid the NULL pointer dereference.
Note that this also prevents ratelimiting these events from GHES.

Fixes: a57f2bfb4a ("PCI/AER: Ratelimit correctable and non-fatal error logging")
Link: https://lore.kernel.org/r/buduna6darbvwfg3aogl5kimyxkggu3n4romnmq6sozut6axeu@clnx7sfsy457/
Signed-off-by: Breno Leitao <leitao@debian.org>
[bhelgaas: add crash details to commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20250929-aer_crash_2-v1-1-68ec4f81c356@debian.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-15 12:04:22 +02:00
..
aer.c PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() 2025-10-15 12:04:22 +02:00
aer_inject.c PCI/AER: Use PCI_DEVID() macro in aer_inject() 2024-09-01 17:05:45 +00:00
aspm.c PCI/ASPM: Consolidate variable declaration and initialization 2025-06-17 17:31:54 -05:00
bwctrl.c PCI: Update Link Speed after retraining 2025-05-15 16:28:44 +00:00
dpc.c PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index 2025-05-23 11:11:36 -05:00
edr.c PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 2024-05-08 15:08:39 -05:00
err.c PCI/ERR: Remove misleading TODO regarding kernel panic 2025-05-30 12:21:19 -05:00
Kconfig PCI/AER: Update aer-inject tool source URL 2024-04-17 10:35:43 -05:00
Makefile PCI: Move TLP Log handling to its own file 2025-01-14 17:38:18 -06:00
pme.c PCI/PME: Use FIELD_GET() 2023-10-24 16:55:45 -05:00
portdrv.c PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge 2025-07-29 11:45:39 -05:00
portdrv.h PCI/bwctrl: Re-add BW notification portdrv as PCIe BW controller 2024-11-16 10:09:04 -06:00
ptm.c pci-v6.17-changes 2025-08-01 13:59:07 -07:00
rcec.c PCI/RCEC: Fix RCiEP device to RCEC association 2021-03-10 15:10:46 -06:00
tlp.c PCI/ERR: Add printk level to pcie_print_tlp_log() 2025-05-23 11:02:03 -05:00