From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757630Ab2KVVQO (ORCPT ); Thu, 22 Nov 2012 16:16:14 -0500 Received: from mail.kernel.org ([198.145.19.201]:49605 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755288Ab2KVSkt (ORCPT ); Thu, 22 Nov 2012 13:40:49 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , alan@lxorguk.ukuu.org.uk, Dan van der Ster , Aaron Lu , Jeff Garzik , Simon Subject: [ 02/83] libata-acpi: Fix NULL ptr derference in ata_acpi_dev_handle Date: Wed, 21 Nov 2012 16:41:24 -0800 Message-Id: <20121122004212.638926219@linuxfoundation.org> X-Mailer: git-send-email 1.8.0.197.g5a90748 In-Reply-To: <20121122004212.371862690@linuxfoundation.org> References: <20121122004212.371862690@linuxfoundation.org> User-Agent: quilt/0.60-2.1.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Aaron Lu commit 60817a680b1bd3341b6909fab7d8a1fcc3a78369 upstream. commit 6b66d95895c149cbc04d4fac5a2f5477c543a8ae didn't handle SATA PMP case in ata_acpi_bind_device and will cause a NULL ptr dereference when user attached a SATA drive to the PMP port. Fix this by checking PMP support. This bug is reported by Dan van der Ster in the following bugzilla page: https://bugzilla.kernel.org/show_bug.cgi?id=48211 Reported-by: Dan van der Ster Tested-by: Dan van der Ster Signed-off-by: Aaron Lu Signed-off-by: Jeff Garzik Tested-by: Simon Signed-off-by: Greg Kroah-Hartman --- drivers/ata/libata-acpi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/drivers/ata/libata-acpi.c +++ b/drivers/ata/libata-acpi.c @@ -1105,10 +1105,15 @@ static int ata_acpi_bind_device(struct a struct acpi_device *acpi_dev; struct acpi_device_power_state *states; - if (ap->flags & ATA_FLAG_ACPI_SATA) - ata_dev = &ap->link.device[sdev->channel]; - else + if (ap->flags & ATA_FLAG_ACPI_SATA) { + if (!sata_pmp_attached(ap)) + ata_dev = &ap->link.device[sdev->id]; + else + ata_dev = &ap->pmp_link[sdev->channel].device[sdev->id]; + } + else { ata_dev = &ap->link.device[sdev->id]; + } *handle = ata_dev_acpi_handle(ata_dev);