From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755395Ab2BASmz (ORCPT ); Wed, 1 Feb 2012 13:42:55 -0500 Received: from mail-yw0-f46.google.com ([209.85.213.46]:48199 "EHLO mail-yw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754698Ab2BASmx convert rfc822-to-8bit (ORCPT ); Wed, 1 Feb 2012 13:42:53 -0500 MIME-Version: 1.0 In-Reply-To: References: <20120122184325.74528207@garik> Date: Wed, 1 Feb 2012 18:42:52 +0000 Message-ID: Subject: Re: [PATCH 1/2] drm/radeon: fix invalid memory access in radeon_atrm_get_bios() From: Dave Airlie To: Alex Deucher Cc: Igor Murzov , David Airlie , Dave Airlie , Igor Murzov , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Sergey V Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jan 24, 2012 at 2:10 PM, Alex Deucher wrote: > On Sun, Jan 22, 2012 at 9:43 AM, Igor Murzov > wrote: >> From 77c912ea1eca50a93a34d5be69f9dc96a8bef0d8 Mon Sep 17 00:00:00 2001 >> From: Igor Murzov >> Date: Sun, 22 Jan 2012 19:02:27 +0400 >> Subject: [PATCH 1/2] drm/radeon: fix invalid memory access in radeon_atrm_get_bios() >> >> At a boot time I observed following bug: >> >> BUG: unable to handle kernel paging request at ffff8800a4244000 >> IP: [] memcpy+0xb/0x120 >> PGD 1816063 PUD 1fe7d067 PMD 1ff9f067 PTE 80000000a4244160 >> Oops: 0000 [#1] SMP DEBUG_PAGEALLOC >> CPU 0 >> Modules linked in: btusb bluetooth brcmsmac brcmutil crc8 cordic b43 radeon(+) >> mac80211 cfg80211 ttm ohci_hcd drm_kms_helper rfkill drm ssb agpgart mmc_core >> sp5100_tco video battery ac thermal processor rtc_cmos thermal_sys snd_hda_codec_hdmi >> joydev snd_hda_codec_conexant button bcma pcmcia snd_hda_intel snd_hda_codec >> snd_hwdep snd_pcm shpchp pcmcia_core k8temp snd_timer atl1c snd psmouse hwmon >> i2c_piix4 i2c_algo_bit soundcore evdev i2c_core ehci_hcd sg serio_raw snd_page_alloc >> loop btrfs >> >> Pid: 1008, comm: modprobe Not tainted 3.3.0-rc1 #21 LENOVO 20046 /AMD CRB >> RIP: 0010:[] [] memcpy+0xb/0x120 >> RSP: 0018:ffff8800aa72db00 EFLAGS: 00010246 >> RAX: ffff8800a4150000 RBX: 0000000000001000 RCX: 0000000000000087 >> RDX: 0000000000000000 RSI: ffff8800a4244000 RDI: ffff8800a4150bc8 >> RBP: ffff8800aa72db78 R08: 0000000000000010 R09: ffffffff8174bbec >> R10: ffffffff812ee010 R11: 0000000000000001 R12: 0000000000001000 >> R13: 0000000000010000 R14: ffff8800a4140000 R15: ffff8800aaba1800 >> FS: 00007ff9a3bd4720(0000) GS:ffff8800afa00000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b >> CR2: ffff8800a4244000 CR3: 00000000a9c18000 CR4: 00000000000006f0 >> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 >> Process modprobe (pid: 1008, threadinfo ffff8800aa72c000, task ffff8800aa0e4000) >> Stack: >> ffffffffa04e7c7b 0000000000000001 0000000000010000 ffff8800aa72db28 >> ffffffff00000001 0000000000001000 ffffffff8113cbef 0000000000000020 >> ffff8800a4243420 ffff880000000002 ffff8800aa72db08 ffff8800a9d42000 >> Call Trace: >> [] ? radeon_atrm_get_bios_chunk+0x8b/0xd0 [radeon] >> [] ? kmalloc_order_trace+0x3f/0xb0 >> [] radeon_get_bios+0x68/0x2f0 [radeon] >> [] rv770_init+0x40/0x280 [radeon] >> [] radeon_device_init+0x560/0x600 [radeon] >> [] radeon_driver_load_kms+0xaf/0x170 [radeon] >> [] drm_get_pci_dev+0x18e/0x2c0 [drm] >> [] radeon_pci_probe+0xad/0xb5 [radeon] >> [] local_pci_probe+0x5f/0xd0 >> [] pci_device_probe+0x88/0xb0 >> [] ? driver_sysfs_add+0x7a/0xb0 >> [] really_probe+0x68/0x180 >> [] driver_probe_device+0x45/0x70 >> [] __driver_attach+0xa3/0xb0 >> [] ? driver_probe_device+0x70/0x70 >> [] bus_for_each_dev+0x5e/0x90 >> [] driver_attach+0x1e/0x20 >> [] bus_add_driver+0xc8/0x280 >> [] driver_register+0x76/0x140 >> [] __pci_register_driver+0x66/0xe0 >> [] drm_pci_init+0x111/0x120 [drm] >> [] ? vga_switcheroo_register_handler+0x3a/0x60 >> [] ? 0xffffffffa0228fff >> [] radeon_init+0xec/0xee [radeon] >> [] do_one_initcall+0x42/0x180 >> [] sys_init_module+0x92/0x1e0 >> [] system_call_fastpath+0x16/0x1b >> Code: 58 2a 43 50 88 43 4e 48 83 c4 08 5b c9 c3 66 90 e8 cb fd ff ff eb >> e6 90 90 90 90 90 90 90 90 90 48 89 f8 89 d1 c1 e9 03 83 e2 07 48 >> a5 89 d1 f3 a4 c3 20 48 83 ea 20 4c 8b 06 4c 8b 4e 08 4c >> RIP [] memcpy+0xb/0x120 >> RSP >> CR2: ffff8800a4244000 >> ---[ end trace fcffa1599cf56382 ]--- >> >> Call to acpi_evaluate_object() not always returns 4096 bytes chunks, >> on my system it can return 2048 bytes chunk, so pass the length of >> retrieved chunk to memcpy(), not the length of the recieving buffer. >> >> Signed-off-by: Igor Murzov Hi Igor, I'm not sure I understand, does your BIOS return 2K chunks always or just for the last chunks? since if it returns 2K always, won't your next patch break stuff? we have a regression report against the second patch, just wondering what it might be. Dave.