linux-kernel - [PATCH] acpi/battery: fix async boot oops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090407091052.GA17822@damson.cased.tu-darmstadt.de>
Date:	Tue, 7 Apr 2009 11:10:52 +0200
From:	Vegard Nossum <vegard.nossum@...il.com>
To:	Len Brown <len.brown@...el.com>
Cc:	Arkadiusz Miskiewicz <a.miskiewicz@...il.com>,
	Arjan van de Ven <arjan@...ux.intel.com>,
	linux-kernel@...r.kernel.org
Subject: [PATCH] acpi/battery: fix async boot oops

>From 85a2a4447ce6b206d9ad20719ed8ac7cc707931c Mon Sep 17 00:00:00 2001
From: Vegard Nossum <vegard.nossum@...il.com>
Date: Tue, 7 Apr 2009 10:55:38 +0200
Subject: [PATCH] acpi/battery: fix async boot oops

2009/4/6 Arkadiusz Miskiewicz <a.miskiewicz@...il.com>:
>
> Pulled Linus git few minutes ago and new oops at boot (happens on every boot).
> Yesterday git version was fine. Oopsed just while/after udev started.

[...]

> BUG: unable to handle kernel NULL pointer dereference at (null)
> IP: [<ffffffffa00fd040>] 0xffffffffa00fd040
> PGD 13998a067 PUD 139979067 PMD 0
> Oops: 0002 [#1] PREEMPT SMP
> last sysfs file: /sys/devices/platform/i8042/modalias
> CPU 0
> Modules linked in: evdev(+) cfg80211(+) battery ac button crc_itu_t xfs exportfs scsi_wait_scan sd_mod crc_t10dif ahci libata scsi_mod
> Pid: 3167, comm: async/0 Not tainted 2.6.29 #12 2764CTO
> RIP: 0010:[<ffffffffa00fd040>]  [<ffffffffa00fd040>] 0xffffffffa00fd040

What happens is that the battery module's init sections are being freed
before the async callback (which was marked __init) has run. This theory
is supported by the fact that the bad RIP value is a vmalloc address.

The immediate fix is to make this a non-init call.

(A better long-term fix is of course to wait with init-section unloading
until a module's async initcalls have been run, which would allow us to
discard this function which is still only run once, after all. Perhaps a
new async_initcall() function for the async/module API, if this is needed
for other modules in the future?)

Reported-by: Arkadiusz Miskiewicz <a.miskiewicz@...il.com>
Cc: Arjan van de Ven <arjan@...ux.intel.com>
Signed-off-by: Vegard Nossum <vegard.nossum@...il.com>
---
 drivers/acpi/battery.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index b0de631..3c7d894 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -903,7 +903,7 @@ static struct acpi_driver acpi_battery_driver = {
 		},
 };
 
-static void __init acpi_battery_init_async(void *unused, async_cookie_t cookie)
+static void acpi_battery_init_async(void *unused, async_cookie_t cookie)
 {
 	if (acpi_disabled)
 		return;
-- 
1.6.0.6

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/