linux-kernel - RE: [PATCH] cpufreq: pcc-cpufreq: sanity check to prevent a NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <66D9D2F0CDB5C9428E6166B01EC85EE1635519C88F@GVW0676EXC.americas.hpqcorp.net>
Date:	Mon, 12 Sep 2011 18:05:26 +0100
From:	"Chumbalkar, Nagananda" <Nagananda.Chumbalkar@...com>
To:	Andrew Morton <akpm@...ux-foundation.org>
CC:	"davej@...emonkey.org.uk" <davej@...emonkey.org.uk>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"cpufreq@...r.kernel.org" <cpufreq@...r.kernel.org>,
	"stable@...nel.org" <stable@...nel.org>
Subject: RE: [PATCH] cpufreq: pcc-cpufreq: sanity check to prevent a NULL
 pointer dereference



>-----Original Message-----
>From: Andrew Morton [mailto:akpm@...ux-foundation.org]
>Sent: Thursday, September 08, 2011 6:53 PM
>To: Chumbalkar, Nagananda
>Cc: davej@...emonkey.org.uk; linux-kernel@...r.kernel.org;
>cpufreq@...r.kernel.org; stable@...nel.org
>Subject: Re: [PATCH] cpufreq: pcc-cpufreq: sanity check to prevent a
>NULL pointer dereference
>
>On Wed, 31 Aug 2011 20:08:45 +0000 (UTC)
>Naga Chumbalkar <nagananda.chumbalkar@...com> wrote:
>
>> If, for whatever reason, "pr" ends up being NULL we would end up in a
>PANIC
>> as seen below:
>>
>> Loading CPUFreq modules[  437.661360] BUG: unable to handle kernel
>NULL pointer
>> dereference at (null)
>> IP: [<ffffffffa0434314>] pcc_cpufreq_cpu_init+0x74/0x220 [pcc_cpufreq]
>>
>> It's better to prevent the PANIC by failing the driver, and allowing
>the system to boot.
>>
>> Signed-off-by: Naga Chumbalkar <nagananda.chumbalkar@...com>
>> Cc: stable@...nel.org
>>
>> diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-
>cpufreq.c
>> index 7b0603e..cdc02ac 100644
>> --- a/drivers/cpufreq/pcc-cpufreq.c
>> +++ b/drivers/cpufreq/pcc-cpufreq.c
>> @@ -261,6 +261,9 @@ static int pcc_get_offset(int cpu)
>>  	pr = per_cpu(processors, cpu);
>>  	pcc_cpu_data = per_cpu_ptr(pcc_cpu_info, cpu);
>>
>> +	if (!pr)
>> +		return -ENODEV;
>> +
>>  	status = acpi_evaluate_object(pr->handle, "PCCP", NULL, &buffer);
>>  	if (ACPI_FAILURE(status))
>>  		return -ENODEV;
>
>hm, from reading drivers/acpi/processor_driver.c it appears that
>per_cpu(processors, n)==NULL is an expected and valid state.  Heaven
>knows what that state actually *means* - apparently this is a secret.
>
>I assume that you've hit this crash in real live code, hence your
>suggestion of a -stable backport?

Yes - the above oops can be reproduced on a shipping Linux distro when, 
for x2APIC implementations, the BIOS does not use the ACPI "Device" 
declaration for processors with Local APIC ID >= 255. Such a declaration 
is necessitated by Sec 8.4 of ACPI 4.0a.

- naga -


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/