lkml.org 
[lkml]   [2010]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[151/197] agp/hp: fixup hp agp after ACPI changes
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Bjorn Helgaas <bjorn.helgaas@hp.com>

    commit 67fe63b0715ccfaefa0af8a6e705c5470ee5cada upstream.

    Commit 15b8dd53f5ffa changed the string in info->hardware_id from a static
    array to a pointer and added a length field. But instead of changing
    "sizeof(array)" to "length", we changed it to "sizeof(length)" (== 4),
    which corrupts the string we're trying to null-terminate.

    We no longer even need to null-terminate the string, but we *do* need to
    check whether we found a HID. If there's no HID, we used to have an empty
    array, but now we have a null pointer.

    The combination of these defects causes this oops:

    Unable to handle kernel NULL pointer dereference (address 0000000000000003)
    modprobe[895]: Oops 8804682956800 [1]
    ip is at zx1_gart_probe+0xd0/0xcc0 [hp_agp]

    http://marc.info/?l=linux-ia64&m=126264484923647&w=2

    Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
    Reported-by: Émeric Maschino <emeric.maschino@gmail.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/char/agp/hp-agp.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- a/drivers/char/agp/hp-agp.c
    +++ b/drivers/char/agp/hp-agp.c
    @@ -488,9 +488,8 @@ zx1_gart_probe (acpi_handle obj, u32 dep
    handle = obj;
    do {
    status = acpi_get_object_info(handle, &info);
    - if (ACPI_SUCCESS(status)) {
    + if (ACPI_SUCCESS(status) && (info->valid & ACPI_VALID_HID)) {
    /* TBD check _CID also */
    - info->hardware_id.string[sizeof(info->hardware_id.length)-1] = '\0';
    match = (strcmp(info->hardware_id.string, "HWP0001") == 0);
    kfree(info);
    if (match) {

    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2010-04-22 21:47    [W:0.024 / U:0.532 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site