Re: [GIT PATCH] ACPI patches for 2.6.25-rc5

[Thomas Renninger <trenn@suse.de>]

On Thu, 2008-03-13 at 13:55 +0100, Andrea Arcangeli wrote:
> On Thu, Mar 13, 2008 at 02:51:45PM +0800, Zhang, Rui wrote:
> > Well, the patch looks good, this may be caused by a BIOS problem.
> > anyway, I wish to get the response from Andrea so that I can do some
> > investigation ASAP.
> 
> Here attached again. syslog isn't available because by the time it
> crash netconsole isn't up yet, but I try to compile it as module and
> see if it crashes by loading it manually later after netconsole
> started. (you didn't ask for syslog until today)
> 
> Hardware is ASUS M2A-VM ACPI BIOS Revision 1604.

If you want to give them a try..., these are the patches which should
fix this BIOS issue (from Len's release branch):

commit c8d16e27a3601d1cbcdfe657eb4ff5e762019e8d
Author: Lin Ming <ming.m.lin@intel.com>
Date:   Fri Feb 29 07:38:54 2008 +0800

    ACPI: fix boot oops regression in thermal
    
    Fix a memory overflow bug when copying
    NULL internal package element object to external.
    
    http://bugzilla.kernel.org/show_bug.cgi?id=10132
    
    Signed-off-by: Lin Ming <ming.m.lin@intel.com>
    Signed-off-by: Zhang Rui <rui.zhang@intel.com>
    Signed-off-by: Len Brown <len.brown@intel.com>

diff --git a/drivers/acpi/utilities/utobject.c b/drivers/acpi/utilities/utobject.c
index 76ee766..e08b3fa 100644
--- a/drivers/acpi/utilities/utobject.c
+++ b/drivers/acpi/utilities/utobject.c
@@ -432,7 +432,7 @@ acpi_ut_get_simple_object_size(union acpi_operand_object *internal_object,
 	 * element -- which is legal)
 	 */
 	if (!internal_object) {
-		*obj_length = 0;
+		*obj_length = sizeof(union acpi_object);
 		return_ACPI_STATUS(AE_OK);
 	}
 

commit b6a163875935ce8e8e85901a7f2b68f7a314d914
Author: Thomas Renninger <trenn@suse.de>
Date:   Wed Mar 12 01:06:24 2008 +0100

    ACPICA: Warn if packages with invalid references are evaluated
    
    And return an error to avoid NULL pointer access by the caller
    Lin Ming's patch avoids corrupted mem access when
    BIOS has invalid references included, the handle is now zero
    instead of corrupted.
    
    Signed-off-by: Thomas Renninger <trenn@suse.de>
    Signed-off-by: Lin Ming <ming.m.lin@intel.com>
    Signed-off-by: Len Brown <len.brown@intel.com>

diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c
index eba55b7..44ea60c 100644
--- a/drivers/acpi/utils.c
+++ b/drivers/acpi/utils.c
@@ -407,6 +407,12 @@ acpi_evaluate_reference(acpi_handle handle,
 			break;
 		}
 
+		if (!element->reference.handle) {
+			printk(KERN_WARNING PREFIX "Invalid reference in"
+			       " package %s\n", pathname);
+			status = AE_NULL_ENTRY;
+			break;
+		}
 		/* Get the  acpi_handle. */
 
 		list->handles[i] = element->reference.handle;