[lvc-project] [PATCH] Drivers: hv: vmbus: Fix potential NULL pointer dereference in vmbus_acpi_add()

[Ваторопин Андрей]

По срабатыванию:

https://lvc-svacer.ispras.ru/r/d3f22ahr8jq9ghitd0m0

В результате исследования удалось доказать, что переменная acpi_disabled
может иметь значение 0, но воспроизвести баг не удалось.

После создания и отправки патча в сообщество был получен ответ:

    I understand the case we are trying to make here, but I tried
    reproducing this at my end, where we are probing VMBus using Devicetree,
    and CONFIG_ACPI is enabled and there is no "acpi=off" in kernel cmdline.
    But still, when the control reaches this particular function -
    vmbus_platform_driver_probe(), acpi_disabled still shows up as 1 for me.
    Can you please share your configuration how you are able to reproduce
    this issue.

Мейнтейнер также не смог воспроизвести падение.

Кроме того, согласно документации:

    There can be two kernel build combinations. One build where
    ACPI is not selected in Kconfig and another one with the ACPI Kconfig.

    In the first case, vfio_platform_acpi_probe will return since
    acpi_disabled is 1. DT user will not see any kind of messages from
    ACPI.

    In the second case, both DT and ACPI is compiled in but the system is
    booting with any of these combinations.

    If the firmware is DT type, then acpi_disabled is 1. The ACPI probe routine
    terminates immediately without any messages.

Документация относится не к нашему драйверу, но переменная acpi_disabled глобальная.

Исходя из этого считаем необходимым перевести задачу в статус confirmed minor


На 10 марта 2026 г., в 11:54, Fedor Pchelkin <pchelkin at ispras.ru<mailto:pchelkin at ispras.ru>> написал:


ВНИМАНИЕ: Письмо отправлено внешним отправителем.
                      Не переходите по ссылкам и не открывайте вложения, если не уверены в их безопасности!


On Tue, 10. Mar 08:42, Ваторопин Андрей wrote:
From: Andrey Vatoropin <a.vatoropin at crpt.ru>

The current driver supports detection via both the ACPI interface and the
Device Tree interface (OF).

In the function vmbus_platform_driver_probe() upon driver detection via OF,
the branch vmbus_device_add() should be executed.

However, the variable "acpi_disabled" is a global variable that, in general
equals 0 when CONFIG_ACPI is enabled. Therefore, it may enter another
branch with vmbus_acpi_add().

Therefore, in the function vmbus_acpi_add(), when the device is not ACPI,
the ACPI_COMPANION macro may return a NULL value, and this pointer is then
dereferenced.

Add a NULL pointer check for the "device" pointer before dereferencing it.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: f83705a51275 ("Driver: VMBus: Add Devicetree support")
Cc: stable at vger.kernel.org
Signed-off-by: Andrey Vatoropin <a.vatoropin at crpt.ru>
---

Для ветки 6.12 понадобится выслать адаптированную версию патча только в
lvc-patches.

  drivers/hv/vmbus_drv.c | 3 +++
  1 file changed, 3 insertions(+)

diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index bc4fc1951ae1..c9ee3375b524 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -2571,6 +2571,9 @@ static int vmbus_acpi_add(struct platform_device *pdev)
   struct acpi_device *ancestor;
   struct acpi_device *device = ACPI_COMPANION(&pdev->dev);

+ if (!device)
+  return -ENODEV;
+
   vmbus_root_device = &device->dev;

   /*
--
2.43.0
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://linuxtesting.org/pipermail/lvc-project/attachments/20260313/42dde5ad/attachment.html>