We copy some strings into "event" but we leave the space after the NULL terminators uninitialized. Later in acpi_bus_receive_event() we copy the whole struct to another buffer with memcpy(). If the new buffer is stored on the stack, kmemcheck prints a warning about the unitialized space after the NULL terminators.

It's true that the space is uninitialized, but it's harmless. The buffer is only used in acpi_system_read_event() and we don't read past the NULL terminators.

This patch changes the kmalloc() to kzalloc() so that we initialize the memory and silence the kmemcheck warning.

Reported-by Christian Casteyde <[email protected]>

Signed-off-by Dan Carpenter <[email protected]>

Signed-off-by Len Brown <[email protected]>

---
 drivers/acpi/bus.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

drivers/acpi/bus.c +1 -1

index 37132dc..743576b 100644
@@ -527,7 +527,7 @@ int acpi_bus_generate_proc_event4(const char *device_class, const char *bus_id,
 	if (!event_is_open)
 		return 0;
 
-	event = kmalloc(sizeof(struct acpi_bus_event), GFP_ATOMIC);
+	event = kzalloc(sizeof(struct acpi_bus_event), GFP_ATOMIC);
 	if (!event)
 		return -ENOMEM;

Signature · 1 line

1.6.0.6

Len Brown

author reviewer

2010-05-06 07:03 UTC #2 lore raw

PATCH 2/9 PNPACPI: compute Address Space length rather than using _LEN

In reply to Len Brown

From: Bjorn Helgaas <[email protected]>

ACPI _CRS Address Space Descriptors have _MIN, _MAX, and _LEN. Linux has been computing Address Spaces as [_MIN to _MIN + _LEN - 1]. Based on the tests in the bug reports below, Windows apparently uses [_MIN to _MAX].

Per spec (ACPI 4.0, Table 6-40), for _CRS fixed-size, fixed location descriptors, "_LEN must be (_MAX - _MIN + 1)", and when that's true, it doesn't matter which way we compute the end. But of course, there are BIOSes that don't follow this rule, and we're better off if Linux handles those exceptions the same way as Windows.

This patch makes Linux use [_MIN to _MAX], as Windows seems to do. This effectively reverts 3162b6f0c5e and replaces it with simpler code.

    https://bugzilla.kernel.org/show_bug.cgi?id=14337 (round)
    https://bugzilla.kernel.org/show_bug.cgi?id=15480 (truncate)

Signed-off-by Bjorn Helgaas <[email protected]>

Signed-off-by Len Brown <[email protected]>

---
 drivers/pnp/pnpacpi/rsparser.c |   26 ++++----------------------
 1 files changed, 4 insertions(+), 22 deletions(-)

drivers/pnp/pnpacpi/rsparser.c +4 ~~-22~~

index 35bb44a..100e4d9 100644
@@ -274,26 +274,6 @@ static void pnpacpi_parse_allocated_busresource(struct pnp_dev *dev,
 	pnp_add_bus_resource(dev, start, end);
 }
 
-static u64 addr_space_length(struct pnp_dev *dev, u64 min, u64 max, u64 len)
-{
-	u64 max_len;
-
-	max_len = max - min + 1;
-	if (len <= max_len)
-		return len;
-
-	/*
-	 * Per 6.4.3.5, _LEN cannot exceed _MAX - _MIN + 1, but some BIOSes
-	 * don't do this correctly, e.g.,
-	 * https://bugzilla.kernel.org/show_bug.cgi?id=15480
-	 */
-	dev_info(&dev->dev,
-	         "resource length %#llx doesn't fit in %#llx-%#llx, trimming\n",
-		 (unsigned long long) len, (unsigned long long) min,
-		 (unsigned long long) max);
-	return max_len;
-}
-
 static void pnpacpi_parse_allocated_address_space(struct pnp_dev *dev,
 						  struct acpi_resource *res)
 {

@@ -309,7 +289,8 @@ static void pnpacpi_parse_allocated_address_space(struct pnp_dev *dev,
 		return;
 	}
 
-	len = addr_space_length(dev, p->minimum, p->maximum, p->address_length);
+	/* Windows apparently computes length rather than using _LEN */
+	len = p->maximum - p->minimum + 1;
 	window = (p->producer_consumer == ACPI_PRODUCER) ? 1 : 0;
 
 	if (p->resource_type == ACPI_MEMORY_RANGE)

@@ -330,7 +311,8 @@ static void pnpacpi_parse_allocated_ext_address_space(struct pnp_dev *dev,
 	int window;
 	u64 len;
 
-	len = addr_space_length(dev, p->minimum, p->maximum, p->address_length);
+	/* Windows apparently computes length rather than using _LEN */
+	len = p->maximum - p->minimum + 1;
 	window = (p->producer_consumer == ACPI_PRODUCER) ? 1 : 0;
 
 	if (p->resource_type == ACPI_MEMORY_RANGE)

Signature · 1 line

1.6.0.6

Len Brown

author reviewer

2010-05-06 07:03 UTC #3 lore raw

PATCH 3/9 ACPI/x86/PCI: compute Address Space length rather than using _LEN

In reply to Len Brown

From: Bjorn Helgaas <[email protected]>

This patch makes Linux use [_MIN to _MAX], as Windows seems to do. This effectively reverts d558b483d5 and 03db42adfe and replaces them with simpler code.

    https://bugzilla.kernel.org/show_bug.cgi?id=14337 (round)
    https://bugzilla.kernel.org/show_bug.cgi?id=15480 (truncate)

Signed-off-by Bjorn Helgaas <[email protected]>

Signed-off-by Len Brown <[email protected]>

---
 arch/x86/pci/acpi.c |   40 ++--------------------------------------
 1 files changed, 2 insertions(+), 38 deletions(-)

arch/x86/pci/acpi.c +2 ~~-38~~

index c7b1ebf..b31ec42 100644
@@ -91,30 +91,6 @@ count_resource(struct acpi_resource *acpi_res, void *data)
 	return AE_OK;
 }
 
-static void
-align_resource(struct acpi_device *bridge, struct resource *res)
-{
-	int align = (res->flags & IORESOURCE_MEM) ? 16 : 4;
-
-	/*
-	 * Host bridge windows are not BARs, but the decoders on the PCI side
-	 * that claim this address space have starting alignment and length
-	 * constraints, so fix any obvious BIOS goofs.
-	 */
-	if (!IS_ALIGNED(res->start, align)) {
-		dev_printk(KERN_DEBUG, &bridge->dev,
-			   "host bridge window %pR invalid; "
-			   "aligning start to %d-byte boundary\n", res, align);
-		res->start &= ~(align - 1);
-	}
-	if (!IS_ALIGNED(res->end + 1, align)) {
-		dev_printk(KERN_DEBUG, &bridge->dev,
-			   "host bridge window %pR invalid; "
-			   "aligning end to %d-byte boundary\n", res, align);
-		res->end = ALIGN(res->end, align) - 1;
-	}
-}
-
 static acpi_status
 setup_resource(struct acpi_resource *acpi_res, void *data)
 {

@@ -124,7 +100,7 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
 	acpi_status status;
 	unsigned long flags;
 	struct resource *root, *conflict;
-	u64 start, end, max_len;
+	u64 start, end;
 
 	status = resource_to_addr(acpi_res, &addr);
 	if (!ACPI_SUCCESS(status))

@@ -141,19 +117,8 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
 	} else
 		return AE_OK;
 
-	max_len = addr.maximum - addr.minimum + 1;
-	if (addr.address_length > max_len) {
-		dev_printk(KERN_DEBUG, &info->bridge->dev,
-			   "host bridge window length %#llx doesn't fit in "
-			   "%#llx-%#llx, trimming\n",
-			   (unsigned long long) addr.address_length,
-			   (unsigned long long) addr.minimum,
-			   (unsigned long long) addr.maximum);
-		addr.address_length = max_len;
-	}
-
 	start = addr.minimum + addr.translation_offset;
-	end = start + addr.address_length - 1;
+	end = addr.maximum + addr.translation_offset;
 
 	res = &info->res[info->res_num];
 	res->name = info->name;

@@ -161,7 +126,6 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
 	res->start = start;
 	res->end = end;
 	res->child = NULL;
-	align_resource(info->bridge, res);
 
 	if (!pci_use_crs) {
 		dev_printk(KERN_DEBUG, &info->bridge->dev,

Signature · 1 line

1.6.0.6

Len Brown

author reviewer

2010-05-06 07:03 UTC #4 lore raw

PATCH 4/9 ACPI: DMI init_set_sci_en_on_resume for multiple Lenovo ThinkPads

In reply to Len Brown

From: Alex Chiang <[email protected]>

Multiple Lenovo ThinkPad models with Intel Core i5/i7 CPUs can successfully suspend/resume once, and then hang on the second s/r cycle.

We got confirmation that this was due to a BIOS defect. The BIOS did not properly set SCI_EN coming out of S3. The BIOS guys hinted that The Other Leading OS ignores the fact that hardware owns the bit and sets it manually.

In any case, an existing DMI table exists for machines where this defect is a known problem. Lenovo promise to fix their BIOS, but for folks who either won't or can't upgrade their BIOS, allow Linux to workaround the issue.

https://bugzilla.kernel.org/show_bug.cgi?id=15407
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/532374

Confirmed by numerous testers in the launchpad bug that using acpi_sleep=sci_force_enable fixes the issue. We add the machines to acpisleep_dmi_table[] to automatically enable this workaround.

Cc [email protected]

Cc Colin King <[email protected]>

Signed-off-by Alex Chiang <[email protected]>

Signed-off-by Len Brown <[email protected]>

---
 drivers/acpi/sleep.c |  120 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 120 insertions(+), 0 deletions(-)

drivers/acpi/sleep.c +120 -0

index f74834a..0fc91a9 100644
@@ -450,6 +450,126 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
 		},
 	},
 	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad T410",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad T510",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad W510",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad X201",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad X201",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad T410",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad T510",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad W510",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad X201",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad X201",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad T410",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad T510",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad W510",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad X201",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Lenovo ThinkPad X201",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
+		},
+	},
+	{
 	.callback = init_old_suspend_ordering,
 	.ident = "Panasonic CF51-2L",
 	.matches = {

Signature · 1 line

1.6.0.6

Len Brown

author reviewer

2010-05-06 07:03 UTC #5 lore raw

PATCH 5/9 PNP: don't check for conflicts with bridge windows

In reply to Len Brown

From: Bjorn Helgaas <[email protected]>

With fa35b4926, I broke a lot of PNP resource assignment. That commit made PNPACPI include bridge windows as PNP resources, and PNP resource assignment treats any enabled overlapping PNP resources as conflicts. Since PCI host bridge windows typically include most of the I/O port space, this makes PNP port assigments fail.

The PCI host bridge driver will eventually use those PNP window resources, so we should make PNP ignore them when checking for conflicts.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=15903

Reported-and-tested-by Pavel Kysilka <[email protected]>

Signed-off-by Bjorn Helgaas <[email protected]>

Signed-off-by Len Brown <[email protected]>

---
 drivers/pnp/resource.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

drivers/pnp/resource.c +4 -0

index 2e54e6a..e3446ab 100644
@@ -211,6 +211,8 @@ int pnp_check_port(struct pnp_dev *dev, struct resource *res)
 			if (tres->flags & IORESOURCE_IO) {
 				if (cannot_compare(tres->flags))
 					continue;
+				if (tres->flags & IORESOURCE_WINDOW)
+					continue;
 				tport = &tres->start;
 				tend = &tres->end;
 				if (ranged_conflict(port, end, tport, tend))

@@ -271,6 +273,8 @@ int pnp_check_mem(struct pnp_dev *dev, struct resource *res)
 			if (tres->flags & IORESOURCE_MEM) {
 				if (cannot_compare(tres->flags))
 					continue;
+				if (tres->flags & IORESOURCE_WINDOW)
+					continue;
 				taddr = &tres->start;
 				tend = &tres->end;
 				if (ranged_conflict(addr, end, taddr, tend))

Signature · 1 line

1.6.0.6

Len Brown

author reviewer

2010-05-06 07:03 UTC #6 lore raw

PATCH 6/9 acpi_pad: "processor_aggregator" name too long

In reply to Len Brown

From: Dan Carpenter <[email protected]>

cpi_device_class can only be 19 characters and a NULL terminator.

With the current name we get a buffer overflow in acpi_pad_add()

	strcpy(acpi_device_class(device), ACPI_PROCESSOR_AGGREGATOR_CLASS);

[[email protected]: call it acpi_pad, per Shaohua Li]

Signed-off-by Dan Carpenter <[email protected]>

Cc walter harms <[email protected]>

Acked-by Shaohua Li <[email protected]>

Cc Len Brown <[email protected]>

Acked-by Pavel Machek <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

Signed-off-by Len Brown <[email protected]>

---
 drivers/acpi/acpi_pad.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

drivers/acpi/acpi_pad.c +1 -1

index 19dacfd..6212213 100644
@@ -31,7 +31,7 @@
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
 
-#define ACPI_PROCESSOR_AGGREGATOR_CLASS	"processor_aggregator"
+#define ACPI_PROCESSOR_AGGREGATOR_CLASS	"acpi_pad"
 #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
 #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
 static DEFINE_MUTEX(isolated_cpus_lock);

Signature · 1 line

1.6.0.6

Len Brown

author reviewer

2010-05-06 07:03 UTC #7 lore raw

PATCH 7/9 power_meter: acpi_device_class "power_meter_resource" too long

In reply to Len Brown

From: Dan Carpenter <[email protected]>

acpi_device_class can only be 19 characters and a NULL terminator.

The current code has a buffer overflow in acpi_power_meter_add():

       strcpy(acpi_device_class(device), ACPI_POWER_METER_CLASS);

Signed-off-by Dan Carpenter <[email protected]>

Cc Len Brown <[email protected]>

Cc "Darrick J. Wong" <[email protected]>

Cc <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

Signed-off-by Len Brown <[email protected]>

---
 drivers/acpi/power_meter.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

drivers/acpi/power_meter.c +1 -1

index e8c32a4..66f6729 100644
@@ -35,7 +35,7 @@
 #define ACPI_POWER_METER_NAME		"power_meter"
 ACPI_MODULE_NAME(ACPI_POWER_METER_NAME);
 #define ACPI_POWER_METER_DEVICE_NAME	"Power Meter"
-#define ACPI_POWER_METER_CLASS		"power_meter_resource"
+#define ACPI_POWER_METER_CLASS		"pwr_meter_resource"
 
 #define NUM_SENSORS			17

Signature · 1 line

1.6.0.6

Len Brown

author reviewer

2010-05-06 07:03 UTC #8 lore raw

PATCH 8/9 sbshc: acpi_device_class "smbus_host_controller" too long

In reply to Len Brown

From: Dan Carpenter <[email protected]>

acpi_device_class can only be 19 characters and a NULL terminator.

With the current name we get a buffer overflow in acpi_smbus_hc_add() when we do:

	strcpy(acpi_device_class(device), ACPI_SMB_HC_CLASS);

Signed-off-by Dan Carpenter <[email protected]>

Cc Alexey Starikovskiy <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

Signed-off-by Len Brown <[email protected]>

---
 drivers/acpi/sbshc.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

drivers/acpi/sbshc.c +1 -1

index 36704b8..f8be23b 100644
@@ -18,7 +18,7 @@
 
 #define PREFIX "ACPI: "
 
-#define ACPI_SMB_HC_CLASS	"smbus_host_controller"
+#define ACPI_SMB_HC_CLASS	"smbus_host_ctl"
 #define ACPI_SMB_HC_DEVICE_NAME	"ACPI SMBus HC"
 
 struct acpi_smb_hc {

Signature · 1 line

1.6.0.6

Len Brown

author reviewer

2010-05-06 07:03 UTC #9 lore raw

PATCH 9/9 ACPI: fix acpi_hest_firmware_first_pci() caused oops

In reply to Len Brown

From: Shaohua Li <[email protected]>

acpi_hest_firmware_first_pci() could be called when acpi is disabled and cause system oops.

Signed-off-by Shaohua Li <[email protected]>

Signed-off-by Len Brown <[email protected]>

---
 drivers/acpi/hest.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

drivers/acpi/hest.c +4 -0

index 4bb18c9..1c527a1 100644
@@ -123,6 +123,10 @@ int acpi_hest_firmware_first_pci(struct pci_dev *pci)
 {
 	acpi_status status = AE_NOT_FOUND;
 	struct acpi_table_header *hest = NULL;
+
+	if (acpi_disabled)
+		return 0;
+
 	status = acpi_get_table(ACPI_SIG_HEST, 1, &hest);
 
 	if (ACPI_SUCCESS(status)) {

Signature · 1 line

1.6.0.6