Bug 44171
| Summary: | BUG: unable to handle kernel NULL pointer dereference at acpi_ns_check_object_type | ||
|---|---|---|---|
| Product: | ACPI | Reporter: | Vlastimil Babka (caster) |
| Component: | ACPICA-Core | Assignee: | acpi_acpica-core (acpi_acpica-core) |
| Status: | CLOSED CODE_FIX | ||
| Severity: | high | CC: | lenb, marc.collin, Robert.Moore, trenn |
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 3.4 | Subsystem: | |
| Regression: | Yes | Bisected commit-id: | |
| Attachments: |
Patch that removes the null pointer dereference
acpidump from the affected machine patch from Bob |
||
|
Description
Vlastimil Babka
2012-07-03 09:07:59 UTC
Created attachment 74631 [details]
Patch that removes the null pointer dereference
As said in the original comment, this removes the null pointer problem, but debug output shows the repaired data is still malformed.
Created attachment 74641 [details]
acpidump from the affected machine
The \_PR_.CPU0._PSD method is indeed ill-formed in the original ASL/AML. And, there is a problem with the ACPICA attempt to repair the return value.
Original code:
Method (_PSD, 0, NotSerialized) // _PSD: Power State Dependencies
{
Return (Package (0x05)
{
0x05,
0x00,
0x00,
0xFD,
0x08
})
}
_PSD is defined to be a "package of packages", thus, the correct code should be:
Method (_PSD, 0, NotSerialized) // _PSD: Power State Dependencies
{
Return (Package (0x01)
{
Package (0x05)
{
0x05,
0x00,
0x00,
0xFD,
0x08
}
})
}
The suggested patch does not work correctly, since it generates additional/different warnings and errors, does not return the correct value, and also results in some memory leaks. We will work on fixing the problem.
Under AcpiExec utility (with suggested patch applied):
- ex \_PR_.CPU0._PSD
Executing \_PR_.CPU0._PSD
nsrepair-0817 [02] NsWrapWithPackage : \_PR_.CPU0._PSD: Wrapped Integer with expected Package object
nsrepair-0817 [02] NsWrapWithPackage : \_PR_.CPU0._PSD: Wrapped Integer with expected Package object
ACPI Warning: For \_PR_.CPU0._PSD: Return Sub-Package[0] is too small - found 1 elements, expected 5 (20120620/nspredef-
1021)
Outstanding: 0x6 allocations after execution
Execution of \_PR_.CPU0._PSD returned object 00035DC8 Buflen 20
[Package] Contains 1 Elements:
[Integer] = 0000000000000005
- q
00545278 Length 0x0008 utobject-269 [Not a Descriptor]
00545030 Length 0x002C utcache-422 [Operand] Package RefCount 0x0001
005451F8 Length 0x002C utcache-422 [Operand] Integer RefCount 0x0001
00545178 Length 0x002C utcache-422 [Operand] Integer RefCount 0x0001
00545108 Length 0x0018 dsobject-516 [Not a Descriptor]
006543A8 Length 0x002C utcache-422 [Operand] Integer RefCount 0x0001
004E5570 Length 0x002C utcache-422 [Operand] Integer RefCount 0x0001
00654130 Length 0x002C utcache-422 [Operand] Package RefCount 0x0001
ACPI Error: 8(0x8) Outstanding allocations (20120620/uttrack-776)
Created attachment 74791 [details] patch from Bob Also posted at: http://marc.info/?l=linux-acpi&m=134136758030378&w=2 *** Bug 44181 has been marked as a duplicate of this bug. *** I have added the patch to our latest master (3.5-rc4) and 12.2 kernel branches (3.4). This will automatically trigger a rebuild and a built kernel package for testing can be retrieved in an hour or so from here: http://download.opensuse.org/repositories/Kernel:/openSUSE-12.2/standard/x86_64/ or here: http://download.opensuse.org/repositories/Kernel:/HEAD/standard/x86_64/ Best check for the date of the rpms and double check after downloading via: rpm -qp --changelog kernel-xy.rpm |less that this changelog is included: Date: Wed Jul 4 10:24:59 2012 +0200 Fix NULL pointer derference in acpi_ns_check_object_type() (kernel bug 44171). Thanks, patch works fine here. is there a way to get it for 32 bits kernel? http://download.opensuse.org/repositories/Kernel:/openSUSE-12.2/standard/i686 > But this one (date) does not have the patch yet: kernel-pae-3.4.4-4.1.i686.rpm 04-Jul-2012 09:30 > get it for 32 bits kernel? Not sure, but the one or other kernel version/flavor currently has build issues. I guess Vlastimil's test is enough to see the patch mainline soon? This one should get a: CC: stable@vger.kernel.org tag and distributions should get the automatically rather quickly. the patch is available for 23bits kernel that work fine (In reply to comment #11) > I guess Vlastimil's test is enough to see the patch mainline soon? > This one should get a: > CC: stable@vger.kernel.org > tag and distributions should get the automatically rather quickly. Should I add this CC myself? patch in comment #5 applied for 3.5-rc, cc 3.4-stable shipped in 3.5-rc7 shipped in 3.4.6 closed. commit 46befd6b38d802dfc5998e7d7938854578b45d9d Author: Bob Moore <robert.moore@intel.com> Date: Wed Jul 4 10:02:32 2012 +0800 ACPICA: Fix possible fault in return package object repair code |