Re: [patch] acpi: fix crash in core ACPI code, triggered by CONFIG_ACPI_PCI_SLOT=y

[Andi Kleen]

Ingo Molnar wrote:

[For acpica issues please always put robert.moore@xxxxxxxxx into Cc. Thanks]
[Bob, will need to resync this into ACPICA]

> I.e. when we called acpi_ns_handle_to_pathname(), we got required_size
> of 0 due to an error condition, but this is passed to the ACPI allocator
> unconditionally:
>
>         required_size = acpi_ns_get_pathname_length(node);
>
>         /* Validate/Allocate/Clear caller buffer */
>
>         status = acpi_ut_initialize_buffer(buffer, required_size);
>         if (ACPI_FAILURE(status)) {
>                 return_ACPI_STATUS(status);
>         }
>
> Where acpi_ut_initialize_buffer(), through many (unnecessary) layers, 
> ends up calling kzalloc(0). Which returns 0x10 and that then causes the 
> crash later on.
>
> So fix both callers of acpi_ns_get_pathname_length(), which can return 0 
> in case of an invalid node.
>
> Also add a WARN_ON() against zero sized allocations in 
> acpi_ut_initialize_buffer() to make it easier to find similar instances 
> of this bug.
>
> I have tested this patch for the past 24 hours and the crash has not 
> reappeared.

Thanks for the detailed analysis and the patch. Patch looks mostly good,
except that the error message could be a little clearer ("Invalid zero 
length node string" perhaps?). It'll need to be backmerged into
the ACPICA code base, but that can be done in parallel without
delaying fixing this bug.

I can add it to my next batch your or you can add it one of yours
if you prefer.

-Andi
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/