Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2232263/?format=api
{ "id": 2232263, "url": "http://patchwork.ozlabs.org/api/patches/2232263/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-pci/patch/20260504065441.99033-1-w15303746062@163.com/", "project": { "id": 28, "url": "http://patchwork.ozlabs.org/api/projects/28/?format=api", "name": "Linux PCI development", "link_name": "linux-pci", "list_id": "linux-pci.vger.kernel.org", "list_email": "linux-pci@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260504065441.99033-1-w15303746062@163.com>", "list_archive_url": null, "date": "2026-05-04T06:54:41", "name": "char: agp: amd64 - fix null-ptr-deref in amd64_fetch_size and related functions", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "9cf77d6bda7ed19b26a6abf34fc44d2abfef00e8", "submitter": { "id": 93320, "url": "http://patchwork.ozlabs.org/api/people/93320/?format=api", "name": null, "email": "w15303746062@163.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-pci/patch/20260504065441.99033-1-w15303746062@163.com/mbox/", "series": [ { "id": 502617, "url": "http://patchwork.ozlabs.org/api/series/502617/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-pci/list/?series=502617", "date": "2026-05-04T06:54:41", "name": "char: agp: amd64 - fix null-ptr-deref in amd64_fetch_size and related functions", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/502617/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2232263/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2232263/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <linux-pci+bounces-53658-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linux-pci@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=163.com header.i=@163.com header.a=rsa-sha256\n header.s=s110527 header.b=Mv47BYqL;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c15:e001:75::12fc:5321; helo=sin.lore.kernel.org;\n envelope-from=linux-pci+bounces-53658-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=163.com header.i=@163.com\n header.b=\"Mv47BYqL\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=117.135.210.4", "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=163.com", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=163.com" ], "Received": [ "from sin.lore.kernel.org (sin.lore.kernel.org\n [IPv6:2600:3c15:e001:75::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g8CC834zZz1yJV\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 04 May 2026 16:57:56 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id 70E0E300406C\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 4 May 2026 06:55:27 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 1B7252BEC34;\n\tMon, 4 May 2026 06:55:25 +0000 (UTC)", "from m16.mail.163.com (m16.mail.163.com [117.135.210.4])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 02FD564A8D;\n\tMon, 4 May 2026 06:55:18 +0000 (UTC)", "from wmy.localdomain (unknown [])\n\tby gzga-smtp-mtada-g0-1 (Coremail) with SMTP id\n _____wD3GtGyQvhp0AomDQ--.49192S2;\n\tMon, 04 May 2026 14:54:54 +0800 (CST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777877725; cv=none;\n b=p/57i9Rbu83C+ox06TsV9L1lNNbc7h9c1j/RhSwy1jwb0gbI2M3lxZdgzuTuZW9lY3ER9ttKB1wC253WR+dWs2RYN49W4P272gdQgKd74HlJOoTl+hjOZvztMYL7ZS4SYFCH4O9PAf9TC1cxI4fhviJH2Eqx34ud2qmwVeYIjCQ=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777877725; c=relaxed/simple;\n\tbh=fihdatZKdC4krblrX+0f/Tf1Id7pyT3INbmeSaqHcD8=;\n\th=From:To:Cc:Subject:Date:Message-Id:MIME-Version;\n b=GBdGCXHE3N4R71xHSJNYorJALXQaRcY0x+iPT91AOhvgiPaVuke57/76JLaX2EBAFQJRcsm7ooHBMoNKUCxNR005TTQVLP+Hx43hcTvUfGcksCTI9SIpEZgiZ/2BZz+mSL3X/RceNpCAw/6IuQw3m8jZGJWuq5aRhEVoO1Uht3s=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=163.com;\n spf=pass smtp.mailfrom=163.com;\n dkim=pass (1024-bit key) header.d=163.com header.i=@163.com\n header.b=Mv47BYqL; arc=none smtp.client-ip=117.135.210.4", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com;\n\ts=s110527; h=From:To:Subject:Date:Message-Id:MIME-Version; bh=Gk\n\tyJeK0xh7ft8l0KrjIr5L7TmwFz7SabyNUN7O8c/TM=; b=Mv47BYqLBTe08xKFOb\n\tsclDIReMVsNlzMuxuwQIXeKPPlaFoMMKxRC+kmPlE79DXuLqbph6XYt4mySRkFm0\n\t4yVqnDBCAJxXGmaQKG9vfpMO1+rAurSIHZ782kW0dRQIXOjO26HxuJJeEyHLnxlP\n\tPKZh7tj7b/h8gnUovfe20wkn4=", "From": "w15303746062@163.com", "To": "airlied@redhat.com", "Cc": "dri-devel@lists.freedesktop.org,\n\tlinux-kernel@vger.kernel.org,\n\tx86@kernel.org,\n\tlinux-pci@vger.kernel.org,\n\tMingyu Wang <25181214217@stu.xidian.edu.cn>", "Subject": "[PATCH] char: agp: amd64 - fix null-ptr-deref in amd64_fetch_size and\n related functions", "Date": "Mon, 4 May 2026 14:54:41 +0800", "Message-Id": "<20260504065441.99033-1-w15303746062@163.com>", "X-Mailer": "git-send-email 2.34.1", "Precedence": "bulk", "X-Mailing-List": "linux-pci@vger.kernel.org", "List-Id": "<linux-pci.vger.kernel.org>", "List-Subscribe": "<mailto:linux-pci+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:linux-pci+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-CM-TRANSID": "_____wD3GtGyQvhp0AomDQ--.49192S2", "X-Coremail-Antispam": "1Uf129KBjvJXoWxtr1UCw1UJFyrZF1fur1UAwb_yoW7GrWxpF\n\t4fZFZxtr4UGr4agF40qa1DCrn5ArZ7XFy5JrZrCw1F9a1vyry8tr1ftFy5ZrWfCFWDXF43\n\tCan8tF4kGFyqyFJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2\n\t9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07jFg4fUUUUU=", "X-CM-SenderInfo": "jzrvjiatxuliiws6il2tof0z/xtbDAB5YPGn4Qr7DNwAA3j" }, "content": "From: Mingyu Wang <25181214217@stu.xidian.edu.cn>\n\nA NULL pointer dereference vulnerability was identified in the AMD64 AGP\ndriver (amd64-agp) during driver initialization and aperture size fetching.\n\nWhen the `amd64_agp` module is loaded on a system without a physical AMD\nNorthbridge (e.g., in a QEMU/KVM virtualized environment with a simulated\nAMD 8151 AGP bridge), the underlying hardware query `node_to_amd_nb(0)`\nreturns NULL.\n\nIn `amd64_fetch_size()`, the code previously attempted to unconditionally\ndereference the `misc` member of the returned pointer:\n `dev = node_to_amd_nb(0)->misc;`\n\nSince `node_to_amd_nb(0)` can return NULL (either due to missing hardware\nor when CONFIG_AMD_NB is disabled), this direct dereference results in a\nGeneral Protection Fault (GPF) and a subsequent kernel panic, as caught\nby KASAN.\n\nFix this by introducing proper sanity checks. Before accessing the `misc`\npointer, explicitly verify that the pointer returned by `node_to_amd_nb()`\nis not NULL.\n\nFurthermore, to prevent similar crashes, this patch sweeps the entire\ndriver and applies the same safeguard to all other functions that iterate\nover or directly access the AMD Northbridge descriptors, including\n`amd_8151_configure()`, `amd64_cleanup()`, `cache_nbs()`, `uli_agp_init()`,\nand `nforce3_agp_init()`.\n\nSigned-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>\n---\n drivers/char/agp/amd64-agp.c | 50 ++++++++++++++++++++++++++++--------\n 1 file changed, 40 insertions(+), 10 deletions(-)", "diff": "diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c\nindex 2505df1f4e69..7bbadfc74ffe 100644\n--- a/drivers/char/agp/amd64-agp.c\n+++ b/drivers/char/agp/amd64-agp.c\n@@ -121,14 +121,16 @@ static struct aper_size_info_32 amd64_aperture_sizes[7] =\n static int amd64_fetch_size(void)\n {\n \tstruct pci_dev *dev;\n+\tstruct amd_northbridge *nb;\n \tint i;\n \tu32 temp;\n \tstruct aper_size_info_32 *values;\n \n-\tdev = node_to_amd_nb(0)->misc;\n-\tif (dev==NULL)\n+\tnb = node_to_amd_nb(0);\n+\tif (!nb || !nb->misc)\n \t\treturn 0;\n \n+\tdev = nb->misc;\n \tpci_read_config_dword(dev, AMD64_GARTAPERTURECTL, &temp);\n \ttemp = (temp & 0xe);\n \tvalues = A_SIZE_32(amd64_aperture_sizes);\n@@ -187,8 +189,12 @@ static int amd_8151_configure(void)\n \n \t/* Configure AGP regs in each x86-64 host bridge. */\n \tfor (i = 0; i < amd_nb_num(); i++) {\n-\t\tagp_bridge->gart_bus_addr =\n-\t\t\tamd64_configure(node_to_amd_nb(i)->misc, gatt_bus);\n+\t\tstruct amd_northbridge *nb = node_to_amd_nb(i);\n+\n+\t\tif (!nb || !nb->misc)\n+\t\t\tcontinue;\n+\n+\t\tagp_bridge->gart_bus_addr = amd64_configure(nb->misc, gatt_bus);\n \t}\n \tamd_flush_garts();\n \treturn 0;\n@@ -204,7 +210,13 @@ static void amd64_cleanup(void)\n \t\treturn;\n \n \tfor (i = 0; i < amd_nb_num(); i++) {\n-\t\tstruct pci_dev *dev = node_to_amd_nb(i)->misc;\n+\t\tstruct amd_northbridge *nb = node_to_amd_nb(i);\n+\t\tstruct pci_dev *dev;\n+\n+\t\tif (!nb || !nb->misc)\n+\t\t\tcontinue;\n+\n+\t\tdev = nb->misc;\n \t\t/* disable gart translation */\n \t\tpci_read_config_dword(dev, AMD64_GARTAPERTURECTL, &tmp);\n \t\ttmp &= ~GARTEN;\n@@ -335,7 +347,13 @@ static int cache_nbs(struct pci_dev *pdev, u32 cap_ptr)\n \n \ti = 0;\n \tfor (i = 0; i < amd_nb_num(); i++) {\n-\t\tstruct pci_dev *dev = node_to_amd_nb(i)->misc;\n+\t\tstruct amd_northbridge *nb = node_to_amd_nb(i);\n+\t\tstruct pci_dev *dev;\n+\n+\t\tif (!nb || !nb->misc)\n+\t\t\tcontinue;\n+\n+\t\tdev = nb->misc;\n \t\tif (fix_northbridge(dev, pdev, cap_ptr) < 0) {\n \t\t\tdev_err(&dev->dev, \"no usable aperture found\\n\");\n #ifdef __x86_64__\n@@ -391,6 +409,7 @@ static int uli_agp_init(struct pci_dev *pdev)\n {\n \tu32 httfea,baseaddr,enuscr;\n \tstruct pci_dev *dev1;\n+\tstruct amd_northbridge *nb;\n \tint i, ret;\n \tunsigned size = amd64_fetch_size();\n \n@@ -411,9 +430,14 @@ static int uli_agp_init(struct pci_dev *pdev)\n \t\tgoto put;\n \t}\n \n+\tnb = node_to_amd_nb(0);\n+\tif (!nb || !nb->misc) {\n+\t\tret = -ENODEV;\n+\t\tgoto put;\n+\t}\n+\n \t/* shadow x86-64 registers into ULi registers */\n-\tpci_read_config_dword (node_to_amd_nb(0)->misc, AMD64_GARTAPERTUREBASE,\n-\t\t\t &httfea);\n+\tpci_read_config_dword(nb->misc, AMD64_GARTAPERTUREBASE, &httfea);\n \n \t/* if x86-64 aperture base is beyond 4G, exit here */\n \tif ((httfea & 0x7fff) >> (32 - 25)) {\n@@ -453,6 +477,7 @@ static int nforce3_agp_init(struct pci_dev *pdev)\n {\n \tu32 tmp, apbase, apbar, aplimit;\n \tstruct pci_dev *dev1;\n+\tstruct amd_northbridge *nb;\n \tint i, ret;\n \tunsigned size = amd64_fetch_size();\n \n@@ -479,9 +504,14 @@ static int nforce3_agp_init(struct pci_dev *pdev)\n \ttmp |= nforce3_sizes[i].size_value;\n \tpci_write_config_dword(dev1, NVIDIA_X86_64_1_APSIZE, tmp);\n \n+\tnb = node_to_amd_nb(0);\n+\tif (!nb || !nb->misc) {\n+\t\tret = -ENODEV;\n+\t\tgoto put;\n+\t}\n+\n \t/* shadow x86-64 registers into NVIDIA registers */\n-\tpci_read_config_dword (node_to_amd_nb(0)->misc, AMD64_GARTAPERTUREBASE,\n-\t\t\t &apbase);\n+\tpci_read_config_dword(nb->misc, AMD64_GARTAPERTUREBASE, &apbase);\n \n \t/* if x86-64 aperture base is beyond 4G, exit here */\n \tif ( (apbase & 0x7fff) >> (32 - 25) ) {\n", "prefixes": [] }