Re: NULL ptr deref in acpi_idle_enter+0x46/0x100

[lihuisong (C)]

Hello Borisla,

Thank you for report this issue.

I try to analyze the reason of this NULL pointer dereference in link [1].
I guess that the root cause of this issue is that max_cstate isn't 
initialized by acpi_processor_cstate_first_run_checks()
before setup cpuidle states in acpi_processor_register_idle_driver().

My analysis is as follows:
The "max_cstate" is ACPI_PROCESSOR_MAX_POWER(8) by default.
The acpi_processor_setup_cstates() use this value to initialize the 
cstates and state_count in acpi_idle_driver.
And I guess the state_count here is more than 1 on your paltform.
Then cpuidle core and cpuidle governor would use the cstates and 
state_count in acpi_idle_driver to select which idle state to enter.

However, from the the log you provided in link[1], the "max_cstate" on 
your platform is limited to 1 which is done in acpi_processor_power_init().
Then the index of 'acpi_cstate' in per_cpu more than one would not be 
initialized due to the updated max_cstate(1) in 
acpi_processor_setup_cpuidle_cx().
As a result, the cx for index > 1 is NULL in acpi_idle_enter().

Could you help me test and verify the analysis above using the 
modifications below on kernel without revert any ACPI idle patch?
-->

diff --git a/drivers/acpi/processor_driver.c 
b/drivers/acpi/processor_driver.c
index 5d824435b26b..554dcb5b41f0 100644

--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -258,12 +258,11 @@ static int __init acpi_processor_driver_init(void)
                acpi_processor_ignore_ppc_init();
        }

+       acpi_processor_register_idle_driver();
        result = driver_register(&acpi_processor_driver);
        if (result < 0)
                return result;

-       acpi_processor_register_idle_driver();
-
        result = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN,
                                   "acpi/cpu-drv:online",
                                   acpi_soft_cpu_online, NULL);
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 8d3122a4e6d0..2aeb3a71cad4 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1391,6 +1391,7 @@ void acpi_processor_register_idle_driver(void)
                if (!pr)
                        continue;

+               acpi_processor_cstate_first_run_checks();
                ret = acpi_processor_get_power_info(pr);
                if (!ret) {
                        pr->flags.power_setup_done = 1;

-->
Note that the location change of acpi_processor_register_idle_driver() 
in acpi_processor_driver_init() is just to resolve the issue that
the cpuidle directory under cpuX does not exist on kernel without the 
code in link [2].

[1] 
https://lore.kernel.org/lkml/20251124200019.GIaSS5U9HhsWBotrQZ@fat_crate.local/
[2] https://lore.kernel.org/all/20240529133446.28446-2- 
Jonathan.Cameron@xxxxxxxxxx/

在 2025/11/25 15:55, Borislav Petkov 写道:
> On Mon, Nov 24, 2025 at 09:00:19PM +0100, Borislav Petkov wrote:
> > Hey,
> >
> > I'm seeing this on one of my old test boxes here with -rc7 + the whole tip
> > lineup.
> Yap, you were right about
>
>    7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration")
>
> having the potential of breaking something.
>
> Reverting it fixes the issue on my machine.
>
> Here's my revert log:
>
> 53f15ee83632 (HEAD -> refs/heads/rc7+) Revert "ACPI: processor: idle: Optimize ACPI idle driver registration"
> 8a2b68f3cfb5 Revert "ACPI: processor: idle: Add module import namespace"
> 8f6f9d389700 Revert "ACPI: processor: idle: Eliminate static variable flat_state_cnt"
> 09ccf5c5a51c Revert "ACPI: processor: idle: Redefine two functions as void"
> 509d71463c8c Revert "ACPI: processor: Do not expose global variable acpi_idle_driver"
> fbd0b9c0ba44 mawk fix
> 03d9f45bc0fd Merge remote-tracking branch 'tip/objtool/core' into rc7+
> 785b41beb928 Merge remote-tracking branch 'tip/master' into rc7+
> 94d77cb7e8ec Merge remote-tracking branch 'ras/edac-for-next' into rc7+
> ...
>
> Thx.