NetBSD Problem Report #60411

From www@netbsd.org  Sun Jul  5 01:39:25 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id C9F151A923A
	for <gnats-bugs@gnats.NetBSD.org>; Sun,  5 Jul 2026 01:39:25 +0000 (UTC)
Message-Id: <20260705013924.8B6011A923F@mollari.NetBSD.org>
Date: Sun,  5 Jul 2026 01:39:24 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: x86 PCI_RESOURCE: null pointer dereference at boot
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60411
>Category:       kern
>Synopsis:       x86 PCI_RESOURCE: null pointer dereference at boot
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jul 05 01:40:00 +0000 2026
>Last-Modified:  Tue Jul 07 14:30:02 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current
>Organization:
The NetMCFG Foundation, Inc.
>Environment:
11.99.6, built 2026-07-04
>Description:
acpi0: MCFG: segment 0, bus 0-255, address 0x00000000e0000000
mpacpi: PCI bus 2 int routing already done!
MCFG: MEMMAP: 0x0000000000000000-0x000000000009efff, size=0x000000000009f000, type=1(Memory)
MCFG: MEMMAP: 0x000000000009f000-0x00000000000bffff, size=0x0000000000021000, type=2(Reserved)
MCFG: MEMMAP: 0x0000000000100000-0x0000000009afffff, size=0x0000000009a00000, type=1(Memory)
MCFG: MEMMAP: 0x0000000009b00000-0x0000000009dfffff, size=0x0000000000300000, type=2(Reserved)
MCFG: MEMMAP: 0x0000000009e00000-0x0000000009efffff, size=0x0000000000100000, type=1(Memory)
MCFG: MEMMAP: 0x0000000009f00000-0x0000000009f3bfff, size=0x000000000003c000, type=4(NVS)
MCFG: MEMMAP: 0x0000000009f3c000-0x0000000068d68fff, size=0x000000005ee2d000, type=1(Memory)
MCFG: MEMMAP: 0x0000000068d69000-0x0000000068d6cfff, size=0x0000000000004000, type=2(Reserved)
MCFG: MEMMAP: 0x0000000068d6d000-0x0000000068d6efff, size=0x0000000000002000, type=1(Memory)
MCFG: MEMMAP: 0x0000000068d6f000-0x0000000068d6ffff, size=0x0000000000001000, type=2(Reserved)
MCFG: MEMMAP: 0x0000000068d70000-0x0000000074f7efff, size=0x000000000c20f000, type=1(Memory)
MCFG: MEMMAP: 0x0000000074f7f000-0x000000007977efff, size=0x0000000004800000, type=2(Reserved)
MCFG: MEMMAP: 0x000000007977f000-0x0000000079f7efff, size=0x0000000000800000, type=4(NVS)
MCFG: MEMMAP: 0x0000000079f7f000-0x0000000079ffefff, size=0x0000000000080000, type=3(ACPI)
MCFG: MEMMAP: 0x0000000079fff000-0x0000000079ffffff, size=0x0000000000001000, type=1(Memory)
MCFG: MEMMAP: 0x000000007a000000-0x000000007bffffff, size=0x0000000002000000, type=2(Reserved)
MCFG: MEMMAP: 0x000000007d790000-0x000000007d7effff, size=0x0000000000060000, type=2(Reserved)
MCFG: MEMMAP: 0x000000007d7f5000-0x000000007fffffff, size=0x000000000280b000, type=2(Reserved)
MCFG: MEMMAP: 0x00000000a0300000-0x00000000a03fffff, size=0x0000000000100000, type=2(Reserved)
MCFG: MEMMAP: 0x00000000fed80000-0x00000000fed80fff, size=0x0000000000001000, type=2(Reserved)
MCFG: MEMMAP: 0x00000000ff000000-0x00000000ffffffff, size=0x0000000001000000, type=2(Reserved)
MCFG: MEMMAP: 0x0000000100000000-0x000000085e2fffff, size=0x000000075e300000, type=1(Memory)
MCFG: MEMMAP: 0x0000000860000000-0x00000008a01fffff, size=0x0000000040200000, type=2(Reserved)
MCFG: bus 0-255, address 0x00000000e0000000: no valid region
acpi0: MCFG: PNP0C01: Type=10(FIXED_MEMORY32), Address=0x00000000000e0000, Length=0x0000000000020000
acpi0: MCFG: PNP0C01: Type=10(FIXED_MEMORY32), Address=0x00000000ff000000, Length=0x0000000001000000
acpi0: MCFG: PNP0C01: Type=7
acpi0: MCFG: PNP0C01: bus 0-255, address 0x00000000e0000000: no valid region
acpi0: MCFG: PNP0C02: Type=10(FIXED_MEMORY32), Address=0x00000000fec00000, Length=0x0000000000002000
acpi0: MCFG: PNP0C02: Type=10(FIXED_MEMORY32), Address=0x00000000fee00000, Length=0x0000000000001000
acpi0: MCFG: PNP0C02: Type=10(FIXED_MEMORY32), Address=0x0000000000000000, Length=0x0000000000000000
acpi0: MCFG: PNP0C02: Type=7
acpi0: MCFG: PNP0C02: bus 0-255, address 0x00000000e0000000: no valid region
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=4
acpi0: MCFG: PNP0C02: Type=7
acpi0: MCFG: PNP0C02: bus 0-255, address 0x00000000e0000000: no valid region
acpi0: MCFG: segment 0, bus 0-255, address 0x00000000e0000000: ignore (invalid address)
acpi0: MCFG: Bus=0, Seg=0xffffaf2b67553440
uvm_fault(0xffffffff81976ee0, 0x0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip 0xffffffff805872c1 cs 0x8 rflags 0x10282 cr2 0x18 ilevel 0x8 rsp 0xffffffff81d6f110
curlwp 0xffffffff8188c1c0 pid 0.0 lowest kstack 0xffffffff81d6a2c0
>How-To-Repeat:
boot an HP Envy 14
>Fix:
Yes, please!

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60411 CVS commit: src/sys/dev/acpi
Date: Sun, 5 Jul 2026 01:51:58 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Jul  5 01:51:58 UTC 2026

 Modified Files:
 	src/sys/dev/acpi: acpi_mcfg.c

 Log Message:
 acpi(4): Reset mcfg_nsegs to zero if we couldn't find any valid ones.

 acpimcfg_probe initializes mcfg_nsegs to the number of segments in
 thef MCFG table, and allocates space at mcfg_segs for an array of
 segments, but leaves the array zero-initialized.

 Later, acpimcfg_init initializes the array with the valid segments,
 and _if there are any_, sets mcfg_nsegs to the number of valid ones.

 But _if there aren't any_, acpimcfg_init would leave mcfg_nsegs set
 to the amount of space allocated in the array, all zero-initialized.

 Later still, if PCI_RESOURCE is enabled, acpimcfg_configure_bus
 would, via acpimcfg_get_segment, search mcfg_segs[0..mcfg_nsegs) for
 an entry matching a PCI segment and bus number, and if they both
 happened to be zero, the first one would match...and
 acpimcfg_configure_bus would fish the (null!)  seg->ms_bst out of the
 all-zero entry and feed it to bus_space_map which would proceed to
 barf on the null pointer.

 To avoid this, we simply have acpimcfg_init reset mcfg_nsegs to zero
 if there are no valid segments found (and free the array, because we
 have no further use for it).

 This doesn't explain why none of the segments were found to be valid
 -- perhaps there's a bug in or around acpi_mcfg.c, or perhaps the
 motherboard firmware on the affected hardware is wrong -- but it
 should make the failure mode a little more graceful like it was
 before without PCI_RESOURCE.

 PR kern/60411: x86 PCI_RESOURCE: null pointer dereference at boot


 To generate a diff of this commit:
 cvs rdiff -u -r1.32 -r1.33 src/sys/dev/acpi/acpi_mcfg.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Stephen Borrill" <sborrill@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60411 CVS commit: [netbsd-11] src/sys/dev/acpi
Date: Tue, 7 Jul 2026 14:28:33 +0000

 Module Name:	src
 Committed By:	sborrill
 Date:		Tue Jul  7 14:28:33 UTC 2026

 Modified Files:
 	src/sys/dev/acpi [netbsd-11]: acpi_mcfg.c

 Log Message:
 Pull up the following revisions(s) (requested by riastradh in ticket #374):
 	sys/dev/acpi/acpi_mcfg.c:	revision 1.33

 x86: Fix crash at boot on some machines with options PCI_RESOURCE,
 in case something goes wrong traversing the MCFG table and no
 segments are found.
 Addresses:
 PR kern/60411: x86 PCI_RESOURCE: null pointer dereference at boot


 To generate a diff of this commit:
 cvs rdiff -u -r1.32 -r1.32.2.1 src/sys/dev/acpi/acpi_mcfg.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Home	PR Database Search