lkml.org 
[lkml]   [2009]   [Sep]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: [origin tree boot crash] NULL pointer dereference, IP: [<ffffffff82b07130>] ibm_find_acpi_device+0x5c/0xf5
From
Date
On Thu, 2009-09-24 at 09:58 +0800, Lin Ming wrote:
> On Thu, 2009-09-24 at 09:35 +0800, Lin Ming wrote:
> > On Thu, 2009-09-24 at 05:30 +0800, Ingo Molnar wrote:
> > > > commit 15b8dd53f5ffaf8e2d9095c423f713423f576c0f
> > > > Date: Mon Jun 29 13:39:29 2009 +0800
> > > >
> > > > ACPICA: Major update for acpi_get_object_info external interface
> > >
> > > this one is causing boot crashes in -tip testing:
> >
> > Hi,
> >
> > Could you please try below commit at linux-acpi-2.6/release branch.
>
> Oh, sorry, commit 718fb0d was already in -tip testing.
>
> (add Bjorn Helgaas <bjorn.helgaas@hp.com>)

Bjorn,

hp-agp.c need the same fix.
Could you refresh your patch with this one?

Thanks,

diff --git a/drivers/char/agp/hp-agp.c b/drivers/char/agp/hp-agp.c
index 7bead4c..d83c4a8 100644
--- a/drivers/char/agp/hp-agp.c
+++ b/drivers/char/agp/hp-agp.c
@@ -492,8 +492,10 @@ zx1_gart_probe (acpi_handle obj, u32 depth, void *context, void **ret)
status = acpi_get_object_info(handle, &info);
if (ACPI_SUCCESS(status)) {
/* TBD check _CID also */
- info->hardware_id.string[sizeof(info->hardware_id.length)-1] = '\0';
- match = (strcmp(info->hardware_id.string, "HWP0001") == 0);
+ if (info->valid & ACPI_VALID_HID)
+ match = !strcmp(info->hardware_id.string, "HWP0001");
+ else
+ match = 0;
kfree(info);
if (match) {
status = hp_acpi_csr_space(handle, &sba_hpa, &length);
diff --git a/drivers/pci/hotplug/acpiphp_ibm.c b/drivers/pci/hotplug/acpiphp_ibm.c
index a9d926b..e7be66d 100644
--- a/drivers/pci/hotplug/acpiphp_ibm.c
+++ b/drivers/pci/hotplug/acpiphp_ibm.c
@@ -406,7 +406,6 @@ static acpi_status __init ibm_find_acpi_device(acpi_handle handle,
__func__, status);
return retval;
}
- info->hardware_id.string[sizeof(info->hardware_id.length) - 1] = '\0';

if (info->current_status && (info->valid & ACPI_VALID_HID) &&
(!strcmp(info->hardware_id.string, IBM_HARDWARE_ID1) ||

>
> Below patch should fix the crash.
> http://patchwork.kernel.org/patch/49090/
>
> Subject: [PATCH v3 01/17] ACPICA: fixup after acpi_get_object_info() change
>
> Commit 15b8dd53f5ffa changed info->hardware_id from a static array to
> a pointer. If hardware_id is non-NULL, it points to a NULL-terminated
> string, so we don't need to terminate it explicitly. However, it may
> be NULL; in that case, we *can't* add a NULL terminator.
>
> This causes a NULL pointer dereference oops for devices without _HID.
>
> Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
> CC: Lin Ming <ming.m.lin@intel.com>
> CC: Bob Moore <robert.moore@intel.com>
> CC: Gary Hade <garyhade@us.ibm.com>
> ---
> drivers/pci/hotplug/acpiphp_ibm.c | 1 -
> 1 files changed, 0 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/pci/hotplug/acpiphp_ibm.c b/drivers/pci/hotplug/acpiphp_ibm.c
> index a9d926b..e7be66d 100644
> --- a/drivers/pci/hotplug/acpiphp_ibm.c
> +++ b/drivers/pci/hotplug/acpiphp_ibm.c
> @@ -406,7 +406,6 @@ static acpi_status __init ibm_find_acpi_device(acpi_handle handle,
> __func__, status);
> return retval;
> }
> - info->hardware_id.string[sizeof(info->hardware_id.length) - 1] = '\0';
>
> if (info->current_status && (info->valid & ACPI_VALID_HID) &&
> (!strcmp(info->hardware_id.string, IBM_HARDWARE_ID1) ||
>
>
> ---
> Lin Ming
>
> >
> > commit 718fb0de8ff88f71b3b91a8ee8e42e60c88e5128
> > Author: Hugh Dickins <hugh.dickins@tiscali.co.uk>
> > Date: Thu Aug 6 23:18:12 2009 +0000
> >
> > ACPI: fix NULL bug for HID/UID string
> >
> > acpi_device->pnp.hardware_id and unique_id are now allocated pointers,
> > replacing the previous arrays. acpi_device_install_notify_handler()
> > oopsed on the NULL hid when probing the video device, and perhaps other
> > uses are vulnerable too. So initialize those pointers to empty strings
> > when there is no hid or uid. Also, free hardware_id and unique_id when
> > when acpi_device is going to be freed.
> >
> > http://bugzilla.kernel.org/show_bug.cgi?id=14096
> >
> > Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
> > Signed-off-by: Lin Ming <ming.m.lin@intel.com>
> > Signed-off-by: Len Brown <len.brown@intel.com>
> >
> > Thanks,
> > Lin Ming
>



\
 
 \ /
  Last update: 2009-09-24 04:25    [W:0.075 / U:0.236 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site