libata-acpi: Fix NULL ptr derference in ata_acpi_dev_handle
PATCH 1/1 libata-acpi: Fix NULL ptr derference in ata_acpi_dev_handle
commit 6b66d95895c149cbc04d4fac5a2f5477c543a8ae didn't handle SATA PMP case in ata_acpi_bind_device and will cause a NULL ptr dereference when user attached a SATA drive to the PMP port. Fix this by checking PMP support.
This bug is reported by Dan van der Ster in the following bugzilla page:
https://bugzilla.kernel.org/show_bug.cgi?id=48211
--- drivers/ata/libata-acpi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/ata/libata-acpi.c +8 -3
@@ -1105,10 +1105,15 @@ static int ata_acpi_bind_device(struct ata_port *ap, struct scsi_device *sdev,struct acpi_device *acpi_dev;struct acpi_device_power_state *states; -if (ap->flags &ATA_FLAG_ACPI_SATA ) - ata_dev = &ap->link.device[sdev->channel]; -else +if (ap->flags &ATA_FLAG_ACPI_SATA ) { +if (!sata_pmp_attached (ap)) + ata_dev = &ap->link.device[sdev->id]; +else + ata_dev = &ap->pmp_link[sdev->channel].device[sdev->id]; + } +else { ata_dev = &ap->link.device[sdev->id]; + } *handle =ata_dev_acpi_handle (ata_dev);
Signature · 1 line
1.7.12.21.g871e293
Hi Dan,
It would be good if you can give this patch a Tested-by tag, thanks.
-Aaron
Quoted 39 lines · Aaron Lu
commit
6b66d95895c149cbc04d4fac5a2f5477c543a8aedidn't handle SATA PMP case inata_acpi_bind_deviceand will cause a NULL ptr dereference when user attached a SATA drive to the PMP port. Fix this by checking PMP support.This bug is reported by Dan van der Ster in the following bugzilla page:
https://bugzilla.kernel.org/show_bug.cgi?id=48211Reported-by Dan van der Ster <[email protected]>Signed-off-by Aaron Lu <[email protected]>Cc <[email protected]>--- drivers/ata/libata-acpi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)drivers/ata/libata-acpi.c +8
-3@@ -1105,10 +1105,15 @@ static int ata_acpi_bind_device(struct ata_port *ap, struct scsi_device *sdev,struct acpi_device *acpi_dev;struct acpi_device_power_state *states; -if (ap->flags &ATA_FLAG_ACPI_SATA ) - ata_dev = &ap->link.device[sdev->channel]; -else +if (ap->flags &ATA_FLAG_ACPI_SATA ) { +if (!sata_pmp_attached (ap)) + ata_dev = &ap->link.device[sdev->id]; +else + ata_dev = &ap->pmp_link[sdev->channel].device[sdev->id]; + } +else { ata_dev = &ap->link.device[sdev->id]; + } *handle =ata_dev_acpi_handle (ata_dev);
Quoted 11 lines · Aaron Lu
commit
6b66d95895c149cbc04d4fac5a2f5477c543a8aedidn't handle SATA PMP case inata_acpi_bind_deviceand will cause a NULL ptr dereference when user attached a SATA drive to the PMP port. Fix this by checking PMP support.This bug is reported by Dan van der Ster in the following bugzilla page:
https://bugzilla.kernel.org/show_bug.cgi?id=48211Reported-by Dan van der Ster <[email protected]>Signed-off-by Aaron Lu <[email protected]>Cc <[email protected]>
Quoted 30 lines
--- drivers/ata/libata-acpi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)drivers/ata/libata-acpi.c +8
-4@@ -1105,10 +1105,15 @@ static int ata_acpi_bind_device(struct ata_port *ap, struct scsi_device *sdev,struct acpi_device *acpi_dev;struct acpi_device_power_state *states; -if (ap->flags &ATA_FLAG_ACPI_SATA ) - ata_dev = &ap->link.device[sdev->channel]; -else +if (ap->flags &ATA_FLAG_ACPI_SATA ) { +if (!sata_pmp_attached (ap)) + ata_dev = &ap->link.device[sdev->id]; +else + ata_dev = &ap->pmp_link[sdev->channel].device[sdev->id]; + } +else { ata_dev = &ap->link.device[sdev->id]; + } *handle =ata_dev_acpi_handle (ata_dev); --1.7.12.21.g871e293
Simple Simon
Tested-byQuoted 6 lines · Dan van der Ster
Quoted 5 lines · Aaron Lu
commit
6b66d95895c149cbc04d4fac5a2f5477c543a8aedidn't handle SATA PMP case inata_acpi_bind_deviceand will cause a NULL ptr dereference when user attached a SATA drive to the PMP port. Fix this by checking PMP support.
Quoted 7 lines
Quoted 6 lines
This bug is reported by Dan van der Ster in the following bugzilla page:
https://bugzilla.kernel.org/show_bug.cgi?id=48211Reported-by Dan van der Ster <[email protected]>Signed-off-by Aaron Lu <[email protected]>Cc <[email protected]>Tested-by Dan van der Ster <[email protected]>
There's a third successful patch test report attached to the bugzilla entry (link above) 10 days ago.
I ran into this, with 3.6.6 failing to boot, I think because of an esata-attached enclosure w/ port multiplier.
Quoted 30 lines
Quoted 30 lines
--- drivers/ata/libata-acpi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)drivers/ata/libata-acpi.c +8
-4@@ -1105,10 +1105,15 @@ static int ata_acpi_bind_device(struct ata_port *ap, struct scsi_device *sdev,struct acpi_device *acpi_dev;struct acpi_device_power_state *states; -if (ap->flags &ATA_FLAG_ACPI_SATA ) - ata_dev = &ap->link.device[sdev->channel]; -else +if (ap->flags &ATA_FLAG_ACPI_SATA ) { +if (!sata_pmp_attached (ap)) + ata_dev = &ap->link.device[sdev->id]; +else + ata_dev = &ap->pmp_link[sdev->channel].device[sdev->id]; + } +else { ata_dev = &ap->link.device[sdev->id]; + } *handle =ata_dev_acpi_handle (ata_dev); --1.7.12.21.g871e293
Quoted 8 lines · Aaron Lu
commit
6b66d95895c149cbc04d4fac5a2f5477c543a8aedidn't handle SATA PMP case inata_acpi_bind_deviceand will cause a NULL ptr dereference when user attached a SATA drive to the PMP port. Fix this by checking PMP support.This bug is reported by Dan van der Ster in the following bugzilla page:
https://bugzilla.kernel.org/show_bug.cgi?id=48211
Quoted 6 lines
Reported-by Dan van der Ster <[email protected]>Signed-off-by Aaron Lu <[email protected]>Cc <[email protected]>--- drivers/ata/libata-acpi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
applied, with added Tested-by labels