* NULL pointer dereference in sony-laptop
@ 2011-03-31 17:28 Alessandro Guido
2011-04-01 0:29 ` Mattia Dongili
0 siblings, 1 reply; 5+ messages in thread
From: Alessandro Guido @ 2011-03-31 17:28 UTC (permalink / raw)
To: malattia; +Cc: platform-driver-x86
With 2.6.39-rc1-00103-g6aba74f, trying to load the sony-laptop module leads to:
Mar 31 19:18:16 [kernel] BUG: unable to handle kernel NULL pointer dereference at (null)
Mar 31 19:18:16 [kernel] IP: [<f8021060>] sony_find_snc_handle+0x10/0x70 [sony_laptop]
Mar 31 19:18:16 [kernel] *pde = 00000000
Mar 31 19:18:16 [kernel] Modules linked in: sony_laptop(+)
Mar 31 19:18:16 [kernel] Pid: 1464, comm: modprobe Not tainted 2.6.39-rc1-00103-g6aba74f #1 Sony Corporation VGN-FS215S
Mar 31 19:18:16 [kernel] EIP: 0060:[<f8021060>] EFLAGS: 00010282 CPU: 0
Mar 31 19:18:16 [kernel] EIP is at sony_find_snc_handle+0x10/0x70 [sony_laptop]
Mar 31 19:18:16 [kernel] EAX: 0000012f EBX: 00000000 ECX: 00000000 EDX: 00000000
Mar 31 19:18:16 [kernel] ESI: f480fe04 EDI: f65d7400 EBP: 00000000 ESP: f480fdb0
Mar 31 19:18:16 [kernel] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
Mar 31 19:18:16 [kernel] f80255cc f480fe04 f65d7400 f80255cc f8023126 f80255ed f80255d0 f80255cc
Mar 31 19:18:16 [kernel] f5c2ef60 f645e300 00000000 c10f35b5 f480fe18 f5c2ef00 f480fe18 c10f2dcc
Mar 31 19:18:16 [kernel] c10f2ad3 000041ed f6747e60 f5f671e0 f645e300 00000000 f65d7400 f8025840
Mar 31 19:18:16 [kernel] [<f8023126>] ? sony_nc_add+0x286/0x8b0 [sony_laptop]
Mar 31 19:18:16 [kernel] [<c10f35b5>] ? sysfs_do_create_link+0xc5/0x1f0
Mar 31 19:18:16 [kernel] [<c10f2dcc>] ? sysfs_add_one+0x1c/0xc0
Mar 31 19:18:16 [kernel] [<c10f2ad3>] ? sysfs_addrm_finish+0x13/0xa0
Mar 31 19:18:16 [kernel] [<c11820a2>] ? acpi_device_probe+0x37/0xee
Mar 31 19:18:16 [kernel] [<c11c6e15>] ? driver_probe_device+0x85/0x190
Mar 31 19:18:16 [kernel] [<c11824a1>] ? acpi_match_device_ids+0x27/0x4d
Mar 31 19:18:16 [kernel] [<c11c6f99>] ? __driver_attach+0x79/0x80
Mar 31 19:18:16 [kernel] [<c11c6f20>] ? driver_probe_device+0x190/0x190
Mar 31 19:18:16 [kernel] [<c11c608b>] ? bus_for_each_dev+0x4b/0x70
Mar 31 19:18:16 [kernel] [<c11c6b36>] ? driver_attach+0x16/0x20
Mar 31 19:18:16 [kernel] [<c11c6f20>] ? driver_probe_device+0x190/0x190
Mar 31 19:18:16 [kernel] [<c11c6827>] ? bus_add_driver+0x197/0x270
Mar 31 19:18:16 [kernel] [<c1181fdf>] ? acpi_device_hid+0x13/0x13
Mar 31 19:18:16 [kernel] [<c11c7497>] ? driver_register+0x57/0xf0
Mar 31 19:18:16 [kernel] [<f808104d>] ? sony_laptop_init+0x4d/0x79 [sony_laptop]
Mar 31 19:18:16 [kernel] [<c10011f3>] ? do_one_initcall+0x33/0x170
Mar 31 19:18:16 [kernel] [<c1042c3d>] ? __blocking_notifier_call_chain+0x4d/0x60
Mar 31 19:18:16 [kernel] [<f8081000>] ? 0xf8080fff
Mar 31 19:18:16 [kernel] [<c10523f1>] ? sys_init_module+0x151/0x1a50
Mar 31 19:18:16 [kernel] [<c10a38c9>] ? sys_close+0x69/0xe0
Mar 31 19:18:16 [kernel] [<c131d30c>] ? sysenter_do_call+0x12/0x22
Mar 31 19:18:16 [kernel] ---[ end trace aac6d83f93fcda93 ]---
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: NULL pointer dereference in sony-laptop
2011-03-31 17:28 NULL pointer dereference in sony-laptop Alessandro Guido
@ 2011-04-01 0:29 ` Mattia Dongili
2011-04-01 13:17 ` [RESEND] " Alessandro Guido
2011-04-01 17:36 ` Matthew Garrett
0 siblings, 2 replies; 5+ messages in thread
From: Mattia Dongili @ 2011-04-01 0:29 UTC (permalink / raw)
To: Alessandro Guido; +Cc: platform-driver-x86
Hi Alessandro,
On Thu, Mar 31, 2011 at 07:28:14PM +0200, Alessandro Guido wrote:
> With 2.6.39-rc1-00103-g6aba74f, trying to load the sony-laptop module leads to:
>
> Mar 31 19:18:16 [kernel] BUG: unable to handle kernel NULL pointer dereference at (null)
> Mar 31 19:18:16 [kernel] IP: [<f8021060>] sony_find_snc_handle+0x10/0x70 [sony_laptop]
> Mar 31 19:18:16 [kernel] *pde = 00000000
> Mar 31 19:18:16 [kernel] Modules linked in: sony_laptop(+)
> Mar 31 19:18:16 [kernel] Pid: 1464, comm: modprobe Not tainted 2.6.39-rc1-00103-g6aba74f #1 Sony Corporation VGN-FS215S
> Mar 31 19:18:16 [kernel] EIP: 0060:[<f8021060>] EFLAGS: 00010282 CPU: 0
> Mar 31 19:18:16 [kernel] EIP is at sony_find_snc_handle+0x10/0x70 [sony_laptop]
> Mar 31 19:18:16 [kernel] EAX: 0000012f EBX: 00000000 ECX: 00000000 EDX: 00000000
> Mar 31 19:18:16 [kernel] ESI: f480fe04 EDI: f65d7400 EBP: 00000000 ESP: f480fdb0
> Mar 31 19:18:16 [kernel] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
> Mar 31 19:18:16 [kernel] f80255cc f480fe04 f65d7400 f80255cc f8023126 f80255ed f80255d0 f80255cc
> Mar 31 19:18:16 [kernel] f5c2ef60 f645e300 00000000 c10f35b5 f480fe18 f5c2ef00 f480fe18 c10f2dcc
> Mar 31 19:18:16 [kernel] c10f2ad3 000041ed f6747e60 f5f671e0 f645e300 00000000 f65d7400 f8025840
> Mar 31 19:18:16 [kernel] [<f8023126>] ? sony_nc_add+0x286/0x8b0 [sony_laptop]
I am under the impression that the SNC devices gets a notification early
during initialization when we still haven't read the available handles.
This patch should fix it but if my thoughts are incorrect then it may
break something else later.
Give it a try and let me know (it may apply with a little fuzz).
Also, could you try to load the module with and without the patch using
the parameter debug=1 ?
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index cfe4493..bed6ebd 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -808,6 +808,11 @@ static int sony_nc_handles_cleanup(struct platform_device *pd)
static int sony_find_snc_handle(int handle)
{
int i;
+
+ /* not initialized yet, return early */
+ if (!handles)
+ return -1;
+
for (i = 0; i < 0x10; i++) {
if (handles->cap[i] == handle) {
dprintk("found handle 0x%.4x (offset: 0x%.2x)\n",
--
mattia
:wq!
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [RESEND] Re: NULL pointer dereference in sony-laptop
2011-04-01 0:29 ` Mattia Dongili
@ 2011-04-01 13:17 ` Alessandro Guido
2011-04-01 17:36 ` Matthew Garrett
1 sibling, 0 replies; 5+ messages in thread
From: Alessandro Guido @ 2011-04-01 13:17 UTC (permalink / raw)
To: Mattia Dongili; +Cc: platform-driver-x86
[-- Attachment #1: Type: text/plain, Size: 1329 bytes --]
[First try got blocked from platform-driver-x86 antispam filter]
On Fri, Apr 1, 2011 at 2:29 AM, Mattia Dongili <malattia@linux.it> wrote:
> Hi Alessandro,
>
> I am under the impression that the SNC devices gets a notification early
> during initialization when we still haven't read the available handles.
> This patch should fix it but if my thoughts are incorrect then it may
> break something else later.
> Give it a try and let me know (it may apply with a little fuzz).
> Also, could you try to load the module with and without the patch using
> the parameter debug=1 ?
>
> diff --git a/drivers/platform/x86/sony-laptop.c
> b/drivers/platform/x86/sony-laptop.c
> index cfe4493..bed6ebd 100644
> --- a/drivers/platform/x86/sony-laptop.c
> +++ b/drivers/platform/x86/sony-laptop.c
> @@ -808,6 +808,11 @@ static int sony_nc_handles_cleanup(struct
> platform_device *pd)
> static int sony_find_snc_handle(int handle)
> {
> int i;
> +
> + /* not initialized yet, return early */
> + if (!handles)
> + return -1;
> +
> for (i = 0; i < 0x10; i++) {
> if (handles->cap[i] == handle) {
> dprintk("found handle 0x%.4x (offset: 0x%.2x)\n",
It works, thanks!
I've attached debug output from sony-laptop with and without the patch
as you requested.
[-- Attachment #2: patched.dmesg --]
[-- Type: application/octet-stream, Size: 989 bytes --]
sony-laptop: Sony Notebook Control Driver v0.6.
sony-laptop: method: name: GBRT, args 0
sony-laptop: method: name: SBRT, args 1
sony-laptop: method: name: GPBR, args 0
sony-laptop: method: name: SPBR, args 1
sony-laptop: method: name: PWAK, args 0
sony-laptop: method: name: GHKE, args 0
sony-laptop: method: name: GWDP, args 0
sony-laptop: method: name: GSNE, args 1
sony-laptop: method: name: SSNE, args 1
sony-laptop: method: name: CSXB, args 1
sony-laptop: method: name: SODV, args 1
sony-laptop: method: name: GDDI, args 0
sony-laptop: method: name: STCS, args 1
sony-laptop: method: name: RBMF, args 1
sony-laptop: method: name: RSBI, args 1
sony-laptop: method: name: CBMF, args 1
input: Sony Vaio Keys as /devices/LNXSYSTM:00/device:00/PNP0A03:00/device:18/SNY5001:00/input/input11
input: Sony Vaio Jogdial as /devices/virtual/input/input12
sony-laptop: Found brightness_default getter: GPBR
sony-laptop: Found brightness_default setter: SPBR
sony-laptop: Found fnkey getter: GHKE
[-- Attachment #3: unpatched.dmesg --]
[-- Type: application/octet-stream, Size: 3169 bytes --]
sony-laptop: Sony Notebook Control Driver v0.6.
sony-laptop: method: name: GBRT, args 0
sony-laptop: method: name: SBRT, args 1
sony-laptop: method: name: GPBR, args 0
sony-laptop: method: name: SPBR, args 1
sony-laptop: method: name: PWAK, args 0
sony-laptop: method: name: GHKE, args 0
sony-laptop: method: name: GWDP, args 0
sony-laptop: method: name: GSNE, args 1
sony-laptop: method: name: SSNE, args 1
sony-laptop: method: name: CSXB, args 1
sony-laptop: method: name: SODV, args 1
sony-laptop: method: name: GDDI, args 0
sony-laptop: method: name: STCS, args 1
sony-laptop: method: name: RBMF, args 1
sony-laptop: method: name: RSBI, args 1
sony-laptop: method: name: CBMF, args 1
input: Sony Vaio Keys as /devices/LNXSYSTM:00/device:00/PNP0A03:00/device:18/SNY5001:00/input/input11
input: Sony Vaio Jogdial as /devices/virtual/input/input12
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<f8021060>] sony_find_snc_handle+0x10/0x70 [sony_laptop]
*pde = 00000000
Oops: 0000 [#1] PREEMPT
last sysfs file: /sys/devices/platform/sony-laptop/uevent
Modules linked in: sony_laptop(+)
Pid: 1494, comm: modprobe Not tainted 2.6.39-rc1-00103-g6aba74f #3 Sony Corporation VGN-FS215S
EIP: 0060:[<f8021060>] EFLAGS: 00010282 CPU: 0
EIP is at sony_find_snc_handle+0x10/0x70 [sony_laptop]
EAX: 0000012f EBX: 00000000 ECX: 00000000 EDX: 00000000
ESI: f6559e04 EDI: f652f400 EBP: 00000000 ESP: f6559db0
DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
Process modprobe (pid: 1494, ti=f6558000 task=f5d06a40 task.ti=f6558000)
Stack:
00000000 f6559e04 f652f400 00000000 f8023126 f8022900 00000000 00000000
00000000 f6512300 00000000 c10f35b5 f6559e18 f5c27f00 f6559e18 c10f2dcc
c10f2ad3 000041ed f6403c00 f5c268a0 f6512300 00000000 f652f400 f8025840
Call Trace:
[<f8023126>] ? sony_nc_add+0x286/0x8b0 [sony_laptop]
[<f8022900>] ? sony_nc_update_status_ng+0x30/0x30 [sony_laptop]
[<c10f35b5>] ? sysfs_do_create_link+0xc5/0x1f0
[<c10f2dcc>] ? sysfs_add_one+0x1c/0xc0
[<c10f2ad3>] ? sysfs_addrm_finish+0x13/0xa0
[<c11820a2>] ? acpi_device_probe+0x37/0xee
[<c11c6e15>] ? driver_probe_device+0x85/0x190
[<c11824a1>] ? acpi_match_device_ids+0x27/0x4d
[<c11c6f99>] ? __driver_attach+0x79/0x80
[<c11c6f20>] ? driver_probe_device+0x190/0x190
[<c11c608b>] ? bus_for_each_dev+0x4b/0x70
[<c11c6b36>] ? driver_attach+0x16/0x20
[<c11c6f20>] ? driver_probe_device+0x190/0x190
[<c11c6827>] ? bus_add_driver+0x197/0x270
[<c1181fdf>] ? acpi_device_hid+0x13/0x13
[<c11c7497>] ? driver_register+0x57/0xf0
[<f808104d>] ? sony_laptop_init+0x4d/0x79 [sony_laptop]
[<c10011f3>] ? do_one_initcall+0x33/0x170
[<c1042c3d>] ? __blocking_notifier_call_chain+0x4d/0x60
[<f8081000>] ? 0xf8080fff
[<c10523f1>] ? sys_init_module+0x151/0x1a50
[<c10a38c9>] ? sys_close+0x69/0xe0
[<c131d30c>] ? sysenter_do_call+0x12/0x22
Code: d0 c3 89 f6 8d bc 27 00 00 00 00 83 fa 01 b8 ea ff ff ff 0f 47 d0 eb e7 8d 76 00 53 31 db 83 ec 0c 8b 0d 6c 64 02 f8 8d 74 26 00 <0f> b7 14 59 39 c2 74 20 43 83 fb 10 75 f2 8b 15 14 64 02 f8 85
EIP: [<f8021060>] sony_find_snc_handle+0x10/0x70 [sony_laptop] SS:ESP 0068:f6559db0
CR2: 0000000000000000
---[ end trace 6fd3f5669318a954 ]---
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: NULL pointer dereference in sony-laptop
2011-04-01 0:29 ` Mattia Dongili
2011-04-01 13:17 ` [RESEND] " Alessandro Guido
@ 2011-04-01 17:36 ` Matthew Garrett
2011-04-02 1:06 ` Mattia Dongili
1 sibling, 1 reply; 5+ messages in thread
From: Matthew Garrett @ 2011-04-01 17:36 UTC (permalink / raw)
To: Mattia Dongili; +Cc: Alessandro Guido, platform-driver-x86
Looks good to me. I'll send this to Linus with a couple of other fixes.
--
Matthew Garrett | mjg59@srcf.ucam.org
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: NULL pointer dereference in sony-laptop
2011-04-01 17:36 ` Matthew Garrett
@ 2011-04-02 1:06 ` Mattia Dongili
0 siblings, 0 replies; 5+ messages in thread
From: Mattia Dongili @ 2011-04-02 1:06 UTC (permalink / raw)
To: Matthew Garrett; +Cc: Alessandro Guido, platform-driver-x86
On Fri, Apr 01, 2011 at 06:36:19PM +0100, Matthew Garrett wrote:
> Looks good to me. I'll send this to Linus with a couple of other fixes.
ok, if you want the full commit as I have it here, here you go:
commit 5d2aa67eee2f55d34fb8be32b69886a49b93c3c1
Author: Mattia Dongili <malattia@linux.it>
Date: Fri Apr 1 10:01:41 2011 +0900
sony-laptop: fix early NULL pointer dereference
The SNC acpi driver could get early notifications before it fully
initializes and that could lead to dereferencing the sony_nc_handles
structure pointer that is still NULL at that stage.
Make sure we return early from the handle lookup function in these
cases.
Signed-off-by: Mattia Dongili <malattia@linux.it>
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index b2ce172..7082c55 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -810,6 +810,11 @@ static int sony_nc_handles_cleanup(struct platform_device *pd)
static int sony_find_snc_handle(int handle)
{
int i;
+
+ /* not initialized yet, return early */
+ if (!handles)
+ return -1;
+
for (i = 0; i < 0x10; i++) {
if (handles->cap[i] == handle) {
dprintk("found handle 0x%.4x (offset: 0x%.2x)\n",
--
mattia
:wq!
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2011-04-02 1:06 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-31 17:28 NULL pointer dereference in sony-laptop Alessandro Guido
2011-04-01 0:29 ` Mattia Dongili
2011-04-01 13:17 ` [RESEND] " Alessandro Guido
2011-04-01 17:36 ` Matthew Garrett
2011-04-02 1:06 ` Mattia Dongili
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.