Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755395Ab2BASmz (ORCPT ); Wed, 1 Feb 2012 13:42:55 -0500 Received: from mail-yw0-f46.google.com ([209.85.213.46]:48199 "EHLO mail-yw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754698Ab2BASmx convert rfc822-to-8bit (ORCPT ); Wed, 1 Feb 2012 13:42:53 -0500 MIME-Version: 1.0 In-Reply-To: References: <20120122184325.74528207@garik> Date: Wed, 1 Feb 2012 18:42:52 +0000 Message-ID: Subject: Re: [PATCH 1/2] drm/radeon: fix invalid memory access in radeon_atrm_get_bios() From: Dave Airlie To: Alex Deucher Cc: Igor Murzov , David Airlie , Dave Airlie , Igor Murzov , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Sergey V Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 5112 Lines: 99 On Tue, Jan 24, 2012 at 2:10 PM, Alex Deucher wrote: > On Sun, Jan 22, 2012 at 9:43 AM, Igor Murzov > wrote: >> From 77c912ea1eca50a93a34d5be69f9dc96a8bef0d8 Mon Sep 17 00:00:00 2001 >> From: Igor Murzov >> Date: Sun, 22 Jan 2012 19:02:27 +0400 >> Subject: [PATCH 1/2] drm/radeon: fix invalid memory access in radeon_atrm_get_bios() >> >> At a boot time I observed following bug: >> >> ?BUG: unable to handle kernel paging request at ffff8800a4244000 >> ?IP: [] memcpy+0xb/0x120 >> ?PGD 1816063 PUD 1fe7d067 PMD 1ff9f067 PTE 80000000a4244160 >> ?Oops: 0000 [#1] SMP DEBUG_PAGEALLOC >> ?CPU 0 >> ?Modules linked in: btusb bluetooth brcmsmac brcmutil crc8 cordic b43 radeon(+) >> ?mac80211 cfg80211 ttm ohci_hcd drm_kms_helper rfkill drm ssb agpgart mmc_core >> ?sp5100_tco video battery ac thermal processor rtc_cmos thermal_sys snd_hda_codec_hdmi >> ?joydev snd_hda_codec_conexant button bcma pcmcia snd_hda_intel snd_hda_codec >> ?snd_hwdep snd_pcm shpchp pcmcia_core k8temp snd_timer atl1c snd psmouse hwmon >> ?i2c_piix4 i2c_algo_bit soundcore evdev i2c_core ehci_hcd sg serio_raw snd_page_alloc >> ?loop btrfs >> >> ?Pid: 1008, comm: modprobe Not tainted 3.3.0-rc1 #21 LENOVO 20046 ? ? ? ? ? ? ? ? ? ? ? ? ? /AMD CRB >> ?RIP: 0010:[] ?[] memcpy+0xb/0x120 >> ?RSP: 0018:ffff8800aa72db00 ?EFLAGS: 00010246 >> ?RAX: ffff8800a4150000 RBX: 0000000000001000 RCX: 0000000000000087 >> ?RDX: 0000000000000000 RSI: ffff8800a4244000 RDI: ffff8800a4150bc8 >> ?RBP: ffff8800aa72db78 R08: 0000000000000010 R09: ffffffff8174bbec >> ?R10: ffffffff812ee010 R11: 0000000000000001 R12: 0000000000001000 >> ?R13: 0000000000010000 R14: ffff8800a4140000 R15: ffff8800aaba1800 >> ?FS: ?00007ff9a3bd4720(0000) GS:ffff8800afa00000(0000) knlGS:0000000000000000 >> ?CS: ?0010 DS: 0000 ES: 0000 CR0: 000000008005003b >> ?CR2: ffff8800a4244000 CR3: 00000000a9c18000 CR4: 00000000000006f0 >> ?DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >> ?DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 >> ?Process modprobe (pid: 1008, threadinfo ffff8800aa72c000, task ffff8800aa0e4000) >> ?Stack: >> ?ffffffffa04e7c7b 0000000000000001 0000000000010000 ffff8800aa72db28 >> ?ffffffff00000001 0000000000001000 ffffffff8113cbef 0000000000000020 >> ?ffff8800a4243420 ffff880000000002 ffff8800aa72db08 ffff8800a9d42000 >> ?Call Trace: >> ?[] ? radeon_atrm_get_bios_chunk+0x8b/0xd0 [radeon] >> ?[] ? kmalloc_order_trace+0x3f/0xb0 >> ?[] radeon_get_bios+0x68/0x2f0 [radeon] >> ?[] rv770_init+0x40/0x280 [radeon] >> ?[] radeon_device_init+0x560/0x600 [radeon] >> ?[] radeon_driver_load_kms+0xaf/0x170 [radeon] >> ?[] drm_get_pci_dev+0x18e/0x2c0 [drm] >> ?[] radeon_pci_probe+0xad/0xb5 [radeon] >> ?[] local_pci_probe+0x5f/0xd0 >> ?[] pci_device_probe+0x88/0xb0 >> ?[] ? driver_sysfs_add+0x7a/0xb0 >> ?[] really_probe+0x68/0x180 >> ?[] driver_probe_device+0x45/0x70 >> ?[] __driver_attach+0xa3/0xb0 >> ?[] ? driver_probe_device+0x70/0x70 >> ?[] bus_for_each_dev+0x5e/0x90 >> ?[] driver_attach+0x1e/0x20 >> ?[] bus_add_driver+0xc8/0x280 >> ?[] driver_register+0x76/0x140 >> ?[] __pci_register_driver+0x66/0xe0 >> ?[] drm_pci_init+0x111/0x120 [drm] >> ?[] ? vga_switcheroo_register_handler+0x3a/0x60 >> ?[] ? 0xffffffffa0228fff >> ?[] radeon_init+0xec/0xee [radeon] >> ?[] do_one_initcall+0x42/0x180 >> ?[] sys_init_module+0x92/0x1e0 >> ?[] system_call_fastpath+0x16/0x1b >> ?Code: 58 2a 43 50 88 43 4e 48 83 c4 08 5b c9 c3 66 90 e8 cb fd ff ff eb >> ?e6 90 90 90 90 90 90 90 90 90 48 89 f8 89 d1 c1 e9 03 83 e2 07 48 >> ?a5 89 d1 f3 a4 c3 20 48 83 ea 20 4c 8b 06 4c 8b 4e 08 4c >> ?RIP ?[] memcpy+0xb/0x120 >> ?RSP >> ?CR2: ffff8800a4244000 >> ?---[ end trace fcffa1599cf56382 ]--- >> >> Call to acpi_evaluate_object() not always returns 4096 bytes chunks, >> on my system it can return 2048 bytes chunk, so pass the length of >> retrieved chunk to memcpy(), not the length of the recieving buffer. >> >> Signed-off-by: Igor Murzov Hi Igor, I'm not sure I understand, does your BIOS return 2K chunks always or just for the last chunks? since if it returns 2K always, won't your next patch break stuff? we have a regression report against the second patch, just wondering what it might be. Dave. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/