ACPI: x86: s2idle: Fix a NULL pointer dereference
authorMario Limonciello <mario.limonciello@amd.com>
Wed, 28 Sep 2022 16:19:34 +0000 (11:19 -0500)
committerRafael J. Wysocki <rafael.j.wysocki@intel.com>
Wed, 28 Sep 2022 19:32:49 +0000 (21:32 +0200)
Ryzen 7000 (Raphael) introduced AMDI0008 for _HID.  This ID was added
in commit ed470febf837 ("ACPI: PM: s2idle: Add support for upcoming AMD
uPEP HID AMDI008"), but then removed in favor of aligning all new IDs
to Rembrandt support in commit fd894f05cf30 ("ACPI: x86: s2idle: If a
new AMD _HID is missing assume Rembrandt").

Unfortunately there was a mistake in commit 100a57379380 ("ACPI: x86:
s2idle: Move _HID handling for AMD systems into structures") that can
lead to a NULL pointer dereference accessing `dev_id->driver_data` in
the sentinel of `amd_hid_ids`.  Fix this dereference.

Reported-by: Richard Gong <Richard.Gong@amd.com>
Fixes: 100a57379380 ("ACPI: x86: s2idle: Move _HID handling for AMD systems into structures")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
drivers/acpi/x86/s2idle.c

index eedd21d8a284db218e122bea3ec49b1a42ea332a..3ae2ba74de92535279c23c4c7b9fc8e8eff8a6e2 100644 (file)
@@ -470,7 +470,7 @@ static int lps0_device_attach(struct acpi_device *adev,
                for (dev_id = &amd_hid_ids[0]; dev_id->id[0]; dev_id++)
                        if (acpi_dev_hid_uid_match(adev, dev_id->id, NULL))
                                break;
-               if (dev_id)
+               if (dev_id->id[0])
                        data = (const struct amd_lps0_hid_device_data *) dev_id->driver_data;
                else
                        data = &amd_rembrandt;