Re: [patch] acpi: fix crash in core ACPI code, triggered by CONFIG_ACPI_PCI_SLOT=y

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Ingo Molnar wrote:

[For acpica issues please always put robert.moore@xxxxxxxxx into Cc. Thanks]
[Bob, will need to resync this into ACPICA]

I.e. when we called acpi_ns_handle_to_pathname(), we got required_size
of 0 due to an error condition, but this is passed to the ACPI allocator
unconditionally:

        required_size = acpi_ns_get_pathname_length(node);

        /* Validate/Allocate/Clear caller buffer */

        status = acpi_ut_initialize_buffer(buffer, required_size);
        if (ACPI_FAILURE(status)) {
                return_ACPI_STATUS(status);
        }

Where acpi_ut_initialize_buffer(), through many (unnecessary) layers, ends up calling kzalloc(0). Which returns 0x10 and that then causes the crash later on.

So fix both callers of acpi_ns_get_pathname_length(), which can return 0 in case of an invalid node.

Also add a WARN_ON() against zero sized allocations in acpi_ut_initialize_buffer() to make it easier to find similar instances of this bug.

I have tested this patch for the past 24 hours and the crash has not reappeared.

Thanks for the detailed analysis and the patch. Patch looks mostly good,
except that the error message could be a little clearer ("Invalid zero length node string" perhaps?). It'll need to be backmerged into
the ACPICA code base, but that can be done in parallel without
delaying fixing this bug.

I can add it to my next batch your or you can add it one of yours
if you prefer.

-Andi
--
To unsubscribe from this list: send the line "unsubscribe linux-pci" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [DMA Engine]     [Linux Coverity]     [Linux USB]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Greybus]

  Powered by Linux