From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753594AbdBFPGV (ORCPT ); Mon, 6 Feb 2017 10:06:21 -0500 Received: from mail-oi0-f49.google.com ([209.85.218.49]:35266 "EHLO mail-oi0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752337AbdBFPGT (ORCPT ); Mon, 6 Feb 2017 10:06:19 -0500 MIME-Version: 1.0 In-Reply-To: References: <20170203205654.28269-1-jprvita@endlessm.com> <94F2FBAB4432B54E8AACC7DFDE6C92E37E563AEA@ORSMSX110.amr.corp.intel.com> <1AE640813FDE7649BE1B193DEA596E886CE36E22@SHSMSX101.ccr.corp.intel.com> From: Daniel Drake Date: Mon, 6 Feb 2017 09:06:17 -0600 Message-ID: Subject: Re: [PATCH] acpica: Fix double-free in acpi_ns_repair_CID() To: =?UTF-8?Q?Jo=C3=A3o_Paulo_Rechi_Vita?= Cc: "Zheng, Lv" , "Moore, Robert" , "Wysocki, Rafael J" , Len Brown , Lin Ming , "linux-acpi@vger.kernel.org" , "devel@acpica.org" , "linux-kernel@vger.kernel.org" , "linux@endlessm.com" , "Jo?o Paulo Rechi Vita" , "Box, David E" , "Schmauss, Erik" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by mail.home.local id v16F6PLa030854 On Mon, Feb 6, 2017 at 8:46 AM, João Paulo Rechi Vita wrote: > Yes, the real problem is i2c_hid not being probed for the touchpad > device on this platform The lack of probe was because when i2c_acpi_add_device() called acpi_bus_get_device() on the handle for the touchpad device (TPL1), it was returning the acpi_device for something totally unrelated. We checked that the original handle-to-device mapping was set up correctly before that point, hence this looks like memory corruption, and the problem went away as soon as we fixed the double free. > [ 0.317002] ACPI Warning: Obj ffffa00472a445e8, Reference Count is > already zero, cannot decrement > [ 0.317178] (20160422/utdelete-442) > >> See this bug for reference: >> https://bugs.acpica.org/show_bug.cgi?id=1336 >> > > Looks like it could be the same problem, indeed. I'm attaching a > kernel log with acpi.trace_debug_layer=0x10091 > acpi.trace_debug_level=0x107FFF > acpi.trace_method_name=_SB.PCI0.I2C1.TPL1._CID > acpi.trace_state=opcode, which is what I was using to investigate the > problem The debug messages in that log stop when the method execution completes, so it may also be useful to share a part of an earlier log where you can see the double freeing happen in a bit more detail. For each of the 2 objects double-freed below we confirmed that the first unreference is the one in acpi_ns_repair_HID and the second unreference is the one removed in JP's patch. nsprepkg-0105 ns_check_package : \_SB.PCI0.I2C1.TPL1._CID Validating return Package of Type 2, Count 2 utobject-0404 ut_allocate_object_des: ffff940f6ba36480 Size 48 utdelete-0750 ut_remove_reference : Obj ffff940f6ba36cf0 Current Refs=1 [To Be Decremented] utdelete-0447 ut_update_ref_count : Obj ffff940f6ba36cf0 Type 02 Refs 00 [Decremented] utdelete-0096 ut_delete_internal_obj: **** String ffff940f6ba36cf0, ptr ffff9f654004e2a8 utdelete-0336 ut_delete_internal_obj: Deleting Object ffff940f6ba36cf0 [String] utdelete-0750 ut_remove_reference : Obj ffff940f6ba36cf0 Current Refs=0 [To Be Decremented] ACPI Warning: Obj ffff940f6ba36cf0, Reference Count is already zero, cannot decrement (20160422/utdelete-442) utdelete-0447 ut_update_ref_count : Obj ffff940f6ba36cf0 Type 02 Refs 00 [Decremented] utdelete-0096 ut_delete_internal_obj: **** String ffff940f6ba36cf0, ptr ffff9f654004e2a8 utdelete-0336 ut_delete_internal_obj: Deleting Object ffff940f6ba36cf0 [String] utobject-0404 ut_allocate_object_des: ffff940f6ba36cf0 Size 48 utdelete-0750 ut_remove_reference : Obj ffff940f6ba36c60 Current Refs=1 [To Be Decremented] utdelete-0447 ut_update_ref_count : Obj ffff940f6ba36c60 Type 02 Refs 00 [Decremented] utdelete-0096 ut_delete_internal_obj: **** String ffff940f6ba36c60, ptr ffff9f654004e2b2 utdelete-0336 ut_delete_internal_obj: Deleting Object ffff940f6ba36c60 [String] utdelete-0750 ut_remove_reference : Obj ffff940f6ba36c60 Current Refs=0 [To Be Decremented] ACPI Warning: Obj ffff940f6ba36c60, Reference Count is already zero, cannot decrement (20160422/utdelete-442) utdelete-0447 ut_update_ref_count : Obj ffff940f6ba36c60 Type 02 Refs 00 [Decremented] utdelete-0096 ut_delete_internal_obj: **** String ffff940f6ba36c60, ptr ffff9f654004e2b2 utdelete-0336 ut_delete_internal_obj: Deleting Object ffff940f6ba36c60 [String] nseval-0315 ns_evaluate : *** Completed evaluation of object _CID *** Thanks, Daniel