litmus-rt.git - The LITMUS^RT kernel.

diff options

author	Igor Murzov <intergalactic.anonymous@gmail.com>	2012-01-22 09:43:25 -0500
committer	Dave Airlie <airlied@redhat.com>	2012-01-24 12:34:02 -0500
commit	a3f83ab1a717c0e6c2f59a4cfdaa10707cc35c55 (patch)
tree	384bd0288fbf5e0e701b074962c29f4d93f2d8e9 /lib/mpi/mpi-internal.h
parent	11ef3f1f8780b64425a4cadbf42a46aa2e36895f (diff)

drm/radeon: fix invalid memory access in radeon_atrm_get_bios()

At a boot time I observed following bug: BUG: unable to handle kernel paging request at ffff8800a4244000 IP: [<ffffffff81275b5b>] memcpy+0xb/0x120 PGD 1816063 PUD 1fe7d067 PMD 1ff9f067 PTE 80000000a4244160 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC CPU 0 Modules linked in: btusb bluetooth brcmsmac brcmutil crc8 cordic b43 radeon(+) mac80211 cfg80211 ttm ohci_hcd drm_kms_helper rfkill drm ssb agpgart mmc_core sp5100_tco video battery ac thermal processor rtc_cmos thermal_sys snd_hda_codec_hdmi joydev snd_hda_codec_conexant button bcma pcmcia snd_hda_intel snd_hda_codec snd_hwdep snd_pcm shpchp pcmcia_core k8temp snd_timer atl1c snd psmouse hwmon i2c_piix4 i2c_algo_bit soundcore evdev i2c_core ehci_hcd sg serio_raw snd_page_alloc loop btrfs Pid: 1008, comm: modprobe Not tainted 3.3.0-rc1 #21 LENOVO 20046 /AMD CRB RIP: 0010:[<ffffffff81275b5b>] [<ffffffff81275b5b>] memcpy+0xb/0x120 RSP: 0018:ffff8800aa72db00 EFLAGS: 00010246 RAX: ffff8800a4150000 RBX: 0000000000001000 RCX: 0000000000000087 RDX: 0000000000000000 RSI: ffff8800a4244000 RDI: ffff8800a4150bc8 RBP: ffff8800aa72db78 R08: 0000000000000010 R09: ffffffff8174bbec R10: ffffffff812ee010 R11: 0000000000000001 R12: 0000000000001000 R13: 0000000000010000 R14: ffff8800a4140000 R15: ffff8800aaba1800 FS: 00007ff9a3bd4720(0000) GS:ffff8800afa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: ffff8800a4244000 CR3: 00000000a9c18000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process modprobe (pid: 1008, threadinfo ffff8800aa72c000, task ffff8800aa0e4000) Stack: ffffffffa04e7c7b 0000000000000001 0000000000010000 ffff8800aa72db28 ffffffff00000001 0000000000001000 ffffffff8113cbef 0000000000000020 ffff8800a4243420 ffff880000000002 ffff8800aa72db08 ffff8800a9d42000 Call Trace: [<ffffffffa04e7c7b>] ? radeon_atrm_get_bios_chunk+0x8b/0xd0 [radeon] [<ffffffff8113cbef>] ? kmalloc_order_trace+0x3f/0xb0 [<ffffffffa04a9298>] radeon_get_bios+0x68/0x2f0 [radeon] [<ffffffffa04c7a30>] rv770_init+0x40/0x280 [radeon] [<ffffffffa047d740>] radeon_device_init+0x560/0x600 [radeon] [<ffffffffa047ef4f>] radeon_driver_load_kms+0xaf/0x170 [radeon] [<ffffffffa043cdde>] drm_get_pci_dev+0x18e/0x2c0 [drm] [<ffffffffa04e7e95>] radeon_pci_probe+0xad/0xb5 [radeon] [<ffffffff81296c5f>] local_pci_probe+0x5f/0xd0 [<ffffffff81297418>] pci_device_probe+0x88/0xb0 [<ffffffff813417aa>] ? driver_sysfs_add+0x7a/0xb0 [<ffffffff813418d8>] really_probe+0x68/0x180 [<ffffffff81341be5>] driver_probe_device+0x45/0x70 [<ffffffff81341cb3>] __driver_attach+0xa3/0xb0 [<ffffffff81341c10>] ? driver_probe_device+0x70/0x70 [<ffffffff813400ce>] bus_for_each_dev+0x5e/0x90 [<ffffffff8134172e>] driver_attach+0x1e/0x20 [<ffffffff81341298>] bus_add_driver+0xc8/0x280 [<ffffffff813422c6>] driver_register+0x76/0x140 [<ffffffff812976d6>] __pci_register_driver+0x66/0xe0 [<ffffffffa043d021>] drm_pci_init+0x111/0x120 [drm] [<ffffffff8133c67a>] ? vga_switcheroo_register_handler+0x3a/0x60 [<ffffffffa0229000>] ? 0xffffffffa0228fff [<ffffffffa02290ec>] radeon_init+0xec/0xee [radeon] [<ffffffff810002f2>] do_one_initcall+0x42/0x180 [<ffffffff8109d8d2>] sys_init_module+0x92/0x1e0 [<ffffffff815407a9>] system_call_fastpath+0x16/0x1b Code: 58 2a 43 50 88 43 4e 48 83 c4 08 5b c9 c3 66 90 e8 cb fd ff ff eb e6 90 90 90 90 90 90 90 90 90 48 89 f8 89 d1 c1 e9 03 83 e2 07 <f3> 48 a5 89 d1 f3 a4 c3 20 48 83 ea 20 4c 8b 06 4c 8b 4e 08 4c RIP [<ffffffff81275b5b>] memcpy+0xb/0x120 RSP <ffff8800aa72db00> CR2: ffff8800a4244000 ---[ end trace fcffa1599cf56382 ]--- Call to acpi_evaluate_object() not always returns 4096 bytes chunks, on my system it can return 2048 bytes chunk, so pass the length of retrieved chunk to memcpy(), not the length of the recieving buffer. Signed-off-by: Igor Murzov <e-mail@date.by> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>

Diffstat (limited to 'lib/mpi/mpi-internal.h')

0 files changed, 0 insertions, 0 deletions

/* * Enclosure Services * * Copyright (C) 2008 James Bottomley <James.Bottomley@HansenPartnership.com> * **----------------------------------------------------------------------------- ** ** This program is free software; you can redistribute it and/or ** modify it under the terms of the GNU General Public License ** version 2 as published by the Free Software Foundation. ** ** This program is distributed in the hope that it will be useful, ** but WITHOUT ANY WARRANTY; without even the implied warranty of ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ** GNU General Public License for more details. ** ** You should have received a copy of the GNU General Public License ** along with this program; if not, write to the Free Software ** Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ** **----------------------------------------------------------------------------- */ #ifndef _LINUX_ENCLOSURE_H_ #define _LINUX_ENCLOSURE_H_ #include <linux/device.h> #include <linux/list.h> /* A few generic types ... taken from ses-2 */ enum enclosure_component_type { ENCLOSURE_COMPONENT_DEVICE = 0x01, ENCLOSURE_COMPONENT_ARRAY_DEVICE = 0x17, }; /* ses-2 common element status */ enum enclosure_status { ENCLOSURE_STATUS_UNSUPPORTED = 0, ENCLOSURE_STATUS_OK, ENCLOSURE_STATUS_CRITICAL, ENCLOSURE_STATUS_NON_CRITICAL, ENCLOSURE_STATUS_UNRECOVERABLE, ENCLOSURE_STATUS_NOT_INSTALLED, ENCLOSURE_STATUS_UNKNOWN, ENCLOSURE_STATUS_UNAVAILABLE, /* last element for counting purposes */ ENCLOSURE_STATUS_MAX }; /* SFF-8485 activity light settings */ enum enclosure_component_setting { ENCLOSURE_SETTING_DISABLED = 0, ENCLOSURE_SETTING_ENABLED = 1, ENCLOSURE_SETTING_BLINK_A_ON_OFF = 2, ENCLOSURE_SETTING_BLINK_A_OFF_ON = 3, ENCLOSURE_SETTING_BLINK_B_ON_OFF = 6, ENCLOSURE_SETTING_BLINK_B_OFF_ON = 7, }; struct enclosure_device; struct enclosure_component; struct enclosure_component_callbacks { void (*get_status)(struct enclosure_device *, struct enclosure_component *); int (*set_status)(struct enclosure_device *, struct enclosure_component *, enum enclosure_status); void (*get_fault)(struct enclosure_device *, struct enclosure_component *); int (*set_fault)(struct enclosure_device *, struct enclosure_component *, enum enclosure_component_setting); void (*get_active)(struct enclosure_device *, struct enclosure_component *); int (*set_active)(struct enclosure_device *, struct enclosure_component *, enum enclosure_component_setting); void (*get_locate)(struct enclosure_device *, struct enclosure_component *); int (*set_locate)(struct enclosure_device *, struct enclosure_component *, enum enclosure_component_setting); void (*get_power_status)(struct enclosure_device *, struct enclosure_component *); int (*set_power_status)(struct enclosure_device *, struct enclosure_component *, int); int (*show_id)(struct enclosure_device *, char *buf); }; struct enclosure_component { void *scratch; struct device cdev; struct device *dev; enum enclosure_component_type type; int number; int fault; int active; int locate; int slot; enum enclosure_status status; int power_status; }; struct enclosure_device { void *scratch; struct list_head node; struct device edev; struct enclosure_component_callbacks *cb; int components; struct enclosure_component component[0]; }; static inline struct enclosure_device * to_enclosure_device(struct device *dev) { return container_of(dev, struct enclosure_device, edev); } static inline struct enclosure_component * to_enclosure_component(struct device *dev) { return container_of(dev, struct enclosure_component, cdev); } struct enclosure_device * enclosure_register(struct device *, const char *, int, struct enclosure_component_callbacks *); void enclosure_unregister(struct enclosure_device *); struct enclosure_component * enclosure_component_alloc(struct enclosure_device *, unsigned int, enum enclosure_component_type, const char *); int enclosure_component_register(struct enclosure_component *); int enclosure_add_device(struct enclosure_device *enclosure, int component, struct device *dev); int enclosure_remove_device(struct enclosure_device *, struct device *); struct enclosure_device *enclosure_find(struct device *dev, struct enclosure_device *start); int enclosure_for_each_device(int (*fn)(struct enclosure_device *, void *), void *data); #endif /* _LINUX_ENCLOSURE_H_ */


context:
space:
mode: