linux-kernel - [BUG][linux-next] NULL pointer dereference in acpiphp_enumerate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20140206085834.76211122@gandalf.local.home>
Date:	Thu, 6 Feb 2014 08:58:34 -0500
From:	Steven Rostedt <rostedt@...dmis.org>
To:	LKML <linux-kernel@...r.kernel.org>, linux-next@...r.kernel.org
Cc:	"Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Stephen Rothwell <sfr@...b.auug.org.au>
Subject: [BUG][linux-next] NULL pointer dereference in
 acpiphp_enumerate_slots

I tested out linux-next yesterday and it crashed on boot up with:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000040^M
 IP: [<ffffffff81274ccc>] acpiphp_enumerate_slots+0xb9/0x195
 PGD 0 
 Oops: 0002 [#1] PREEMPT SMP 
 Modules linked in:^M
 CPU: 2 PID: 1 Comm: swapper/0 Not tainted 3.14.0-rc1-test+ #179^M
 Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007
 task: ffff88007abbd3d0 ti: ffff88007abbe000 task.ti: ffff88007abbe000^M
 RIP: 0010:[<ffffffff81274ccc>]  [<ffffffff81274ccc>] acpiphp_enumerate_slots+0xb9/0x195^M
 RSP: 0000:ffff88007abbfa18  EFLAGS: 00010292^M
 RAX: 0000000000000000 RBX: ffff880079b5bc80 RCX: ffff880079b5bc80^M
 RDX: ffff88007d500000 RSI: 0000000000000000 RDI: ffffffff814f1143^M
 RBP: ffff88007a8228d0 R08: ffff880079b5bc80 R09: 0000000000000002^M
 R10: ffff88007abbd3d0 R11: ffff880079b5bc80 R12: ffff880079c05118^M
 R13: ffff8800798c6000 R14: ffff880079aae000 R15: 0000000000000000^M
 FS:  0000000000000000(0000) GS:ffff88007d500000(0000) knlGS:0000000000000000^M
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 0000000000000040 CR3: 0000000001a0b000 CR4: 00000000000007e0^M
 Stack:^M
  0000000000000000 0000000000000246 ffff880079c05000 ffff880079c05000
  ffff880079c05800 ffff880079aae000 ffff880079c05118 ffffffff814e3080
  ffff880079b59818 00023c1181261011 ffff880079b59800 0000000000000000
 Call Trace:^M
  [<ffffffff814e3080>] ? pci_add_new_bus+0x284/0x2be^M
  [<ffffffff8125ea53>] ? pci_scan_bridge+0x195/0x507^M
  [<ffffffff8125db95>] ? pci_read_bridge_bases+0x2b6/0x39e^M
  [<ffffffff8125ee8b>] ? pci_scan_child_bus+0xc6/0x10f^M
  [<ffffffff8125ea8a>] ? pci_scan_bridge+0x1cc/0x507
  [<ffffffff814e2d98>] ? pci_scan_single_device+0x41/0xa5
  [<ffffffff8125ee8b>] ? pci_scan_child_bus+0xc6/0x10f^M
  [<ffffffff81403b9c>] ? pci_acpi_scan_root+0x3a6/0x429^M
  [<ffffffff812963fd>] ? acpi_pci_root_add+0x2f9/0x3d4^M
  [<ffffffff81292b0c>] ? acpi_bus_attach+0xa3/0x129^M
  [<ffffffff81292b59>] ? acpi_bus_attach+0xf0/0x129
  [<ffffffff81292b59>] ? acpi_bus_attach+0xf0/0x129^M
  [<ffffffff81292bf0>] ? acpi_bus_scan+0x5e/0x67
  [<ffffffff81b31e8f>] ? acpi_sleep_proc_init+0x29/0x29^M
  [<ffffffff81b32291>] ? acpi_scan_init+0x5b/0x186^M
  [<ffffffff81b31e8f>] ? acpi_sleep_proc_init+0x29/0x29^M
  [<ffffffff81b31e8f>] ? acpi_sleep_proc_init+0x29/0x29
  [<ffffffff81b32093>] ? acpi_init+0x204/0x269^M
  [<ffffffff810002ae>] ? do_one_initcall+0x9d/0x123^M
  [<ffffffff81057dc6>] ? parse_args+0x21f/0x30d
  [<ffffffff81af8eb2>] ? kernel_init_freeable+0x179/0x20a^M
  [<ffffffff81af86e6>] ? do_early_param+0x7d/0x7d
  [<ffffffff814f51b2>] ? preempt_count_sub+0xba/0xc6
  [<ffffffff814e07cd>] ? rest_init+0x81/0x81
  [<ffffffff814e07d8>] ? kernel_init+0xb/0x106^M
  [<ffffffff814f822c>] ? ret_from_fork+0x7c/0xb0
  [<ffffffff814e07cd>] ? rest_init+0x81/0x81^M
 Code: 38 49 81 c4 18 01 00 00 48 89 43 40 4c 89 e7 e8 90 43 08 00 48 8b 43 38 48 83 78 10 00 74 52 e8 17 cd 01 00 49 8b 85 e0 01 00 00 <ff> 40 40 48 85 c0 75 28 e8 17 cd 01 00 4c 89 e7 e8 93 43 08 00 ^M
 RIP  [<ffffffff81274ccc>] acpiphp_enumerate_slots+0xb9/0x195
  RSP <ffff88007abbfa18>^M
 CR2: 0000000000000040



I set up ktest to perform a bisect it it ended with this commit:

commit d95c405afec934e0c0c46d434b3b62b51c880fe9
Author: Rafael J. Wysocki <rafael.j.wysocki@...el.com>
Date:   Tue Feb 4 00:43:26 2014 +0100

    ACPI / hotplug / PCI: Consolidate ACPIPHP with ACPI core hotplug


Attached is my config.

-- Steve

Download attachment "config" of type "application/octet-stream" (101393 bytes)