| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1237524810.879.19.camel@minggr>
Date: Fri, 20 Mar 2009 12:53:30 +0800
From: Lin Ming <ming.m.lin@...el.com>
To: Jiri Slaby <jirislaby@...il.com>
Cc: "Moore, Robert" <robert.moore@...el.com>,
"lenb@...nel.org" <lenb@...nel.org>,
"linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>,
"Rafael J. Wysocki" <rjw@...k.pl>,
linux-kernel <linux-kernel@...r.kernel.org>,
"torvalds@...ux-foundation.org" <torvalds@...ux-foundation.org>
Subject: Re: 2.6.29 acpi regression: acpi_ex_extract_from_field -- div by
zero
On Fri, 2009-03-20 at 00:06 +0800, Jiri Slaby wrote:
> On 18.3.2009 09:08, Jiri Slaby wrote:
> > On 16.3.2009 17:31, Jiri Slaby wrote:
> >> On 16.3.2009 04:42, Lin Ming wrote:
> >>>> sometimes, when booting up/resuming from disk, I get an oops[1].
> >>>>
> >>>> obj_desc->common_field.access_bit_width is zero, but even after the
> >>>> loop. Division before the loop is apparently OK.
> >>>
> >>> Would please try below debug patch to see which region filed is
> >>> accessed?
> >
> > I'm confused, but keep trying.
>
> Got it again. obj_desc->common_field.node is martian too (0x4000000), so
> the added acpi_get_name dies:
> http://www.fi.muni.cz/~xslaby/sklad/panics/acpi_oops1.png
>
> Whole common_field seems to be mangled. Ideas?
I should save the field object and node path name at the entry of
acpi_ex_extract_from_field.
Would you please try below debug patch?
I also add a return statement before the fault to disallow the oops to
flood screen.
Thanks.
diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
index ef58ac4..5109f5b 100644
--- a/drivers/acpi/acpica/exfldio.c
+++ b/drivers/acpi/acpica/exfldio.c
@@ -670,6 +670,34 @@ acpi_ex_write_with_update_rule(union acpi_operand_object *obj_desc,
*
******************************************************************************/
+void debug_dump_field(union acpi_operand_object *obj_desc)
+{
+ struct acpi_object_field_common *obj_field;
+
+ if (!obj_desc) {
+ printk(KERN_DEBUG "ACPI Debug: NULL field object\n");
+ return;
+ }
+
+ printk(KERN_DEBUG "next_object: %p\n", obj_desc->common.next_object);
+ printk(KERN_DEBUG "descriptor_type: %x\n", obj_desc->common.descriptor_type);
+ printk(KERN_DEBUG "type: %x\n", obj_desc->common.type);
+ printk(KERN_DEBUG "reference_count: %x\n", obj_desc->common.reference_count);
+ printk(KERN_DEBUG "flags: %x\n", obj_desc->common.flags);
+
+ obj_field = &obj_desc->common_field;
+
+ printk(KERN_DEBUG "field_flags: %x\n", obj_field->field_flags);
+ printk(KERN_DEBUG "attribute: %x\n", obj_field->attribute);
+ printk(KERN_DEBUG "access_byte_width: %x\n", obj_field->access_byte_width);
+ printk(KERN_DEBUG "node: %p\n", obj_field->node);
+ printk(KERN_DEBUG "bit_length: %x\n", obj_field->bit_length);
+ printk(KERN_DEBUG "base_byte_offset: %x\n", obj_field->base_byte_offset);
+ printk(KERN_DEBUG "value: %x\n", obj_field->value);
+ printk(KERN_DEBUG "start_field_bit_offset: %x\n", obj_field->start_field_bit_offset);
+ printk(KERN_DEBUG "access_bit_width: %x\n", obj_field->access_bit_width);
+}
+
acpi_status
acpi_ex_extract_from_field(union acpi_operand_object *obj_desc,
void *buffer, u32 buffer_length)
@@ -683,9 +711,24 @@ acpi_ex_extract_from_field(union acpi_operand_object *obj_desc,
u32 datum_count;
u32 field_datum_count;
u32 i;
+ struct acpi_buffer name_buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+ union acpi_operand_object backup_obj;
ACPI_FUNCTION_TRACE(ex_extract_from_field);
+ /* backup the object */
+ memcpy(&backup_obj, obj_desc, sizeof(*obj_desc));
+
+ name_buffer.pointer = NULL;
+ if (obj_desc->common_field.node) {
+ status = acpi_get_name(obj_desc->common_field.node,
+ ACPI_FULL_PATHNAME, &name_buffer);
+ if (ACPI_FAILURE(status)) {
+ printk(KERN_DEBUG "ACPI Debug: %s\n",
+ acpi_format_exception(status));
+ }
+ }
+
/* Validate target buffer and clear it */
if (buffer_length <
@@ -765,6 +808,29 @@ acpi_ex_extract_from_field(union acpi_operand_object *obj_desc,
raw_datum >> obj_desc->common_field.start_field_bit_offset;
}
+ if (obj_desc->common_field.bit_length == 0 ||
+ obj_desc->common_field.access_bit_width == 0) {
+
+ /* oops, dump the object */
+ if (name_buffer.pointer) {
+ printk(KERN_DEBUG "ACPI Debug: field node path: %s\n",
+ (char *) name_buffer.pointer);
+ }
+
+ printk(KERN_DEBUG "ACPI Debug: The original object:\n");
+ debug_dump_field(&backup_obj);
+
+ printk(KERN_DEBUG "ACPI Debug: The bad object:\n");
+ debug_dump_field(obj_desc);
+
+ kfree(name_buffer.pointer);
+
+ /* we return here to disallow the oops to flood screen */
+ return_ACPI_STATUS(AE_ERROR);
+ }
+
+ kfree(name_buffer.pointer);
+
/* Mask off any extra bits in the last datum */
buffer_tail_bits = obj_desc->common_field.bit_length %
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists