linux-kernel - Re: [PATCH v3 11/12] ACPI: video: convert to acpi_get_pci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090625230535.GE1723@ldl.fc.hp.com>
Date:	Thu, 25 Jun 2009 17:05:35 -0600
From:	Alex Chiang <achiang@...com>
To:	Alex Riesen <raa.lkml@...il.com>
Cc:	lenb@...nel.org, twmoure@...pr.net, alessandro.suardi@...il.com,
	linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org,
	Thomas Renninger <trenn@...e.de>, linux-pci@...r.kernel.org
Subject: Re: [PATCH v3 11/12] ACPI: video: convert to acpi_get_pci_dev

Hi Alex,

Thanks for the bug report and sorry for the troubles.

I've already got a debug patch here:

	http://thread.gmane.org/gmane.linux.kernel/857228/focus=857468

Perhaps you can try it too?

Len, in the mean time, can you please apply this as an emergency,
"let's not crash anyone else's machine" while I try and figure
out why the ACPI video driver breaks my assumptions?

Troy, I applied your S-o-B, but maybe that was not a good
assumption on my part? To be sure, could you please respond with
your S-o-B?

Thanks.

/ac, wearing a brown paper bag

From: Troy Moure <twmoure@...pr.net>

ACPI: prevent NULL deref in acpi_get_pci_dev()

When the ACPI video driver initializes, it does a namespace walk
looking for for supported devices. When we find an appropriate
handle, we walk up the ACPI tree looking for a PCI root bus, and
then walk back down the PCI bus, assuming that every device
inbetween is a P2P bridge.

This assumption is not correct, and is reported broken on at
least:

	Dell Latitude E6400
	ThinkPad X61
	Dell XPS M1330

Add a NULL deref check to prevent boot panics.

Reported-by: Alessandro Suardi <alessandro.suardi@...il.com>
Signed-off-by: Troy Moure <twmoure@...pr.net>
Signed-off-by: Alex Chiang <achiang@...com>
---
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 8a5bf3b..55b5b90 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -395,7 +395,7 @@ struct pci_dev *acpi_get_pci_dev(acpi_handle handle)
 		fn  = adr & 0xffff;

 		pdev = pci_get_slot(pbus, PCI_DEVFN(dev, fn));
-		if (hnd == handle)
+		if (!pdev || hnd == handle)
 			break;

 		pbus = pdev->subordinate;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/