Seunghun Han
3b2d69114f
ACPICA: Namespace: fix operand cache leak ...
ACPICA commit a23325b2e583556eae88ed3f764e457786bf4df6
I found some ACPI operand cache leaks in ACPI early abort cases.
Boot log of ACPI operand cache leak is as follows:
>[ 0.174332] ACPI: Added _OSI(Module Device)
>[ 0.175504] ACPI: Added _OSI(Processor Device)
>[ 0.176010] ACPI: Added _OSI(3.0 _SCP Extensions)
>[ 0.177032] ACPI: Added _OSI(Processor Aggregator Device)
>[ 0.178284] ACPI: SCI (IRQ16705) allocation failed
>[ 0.179352] ACPI Exception: AE_NOT_ACQUIRED, Unable to install
System Control Interrupt handler (20160930/evevent-131)
>[ 0.180008] ACPI: Unable to start the ACPI Interpreter
>[ 0.181125] ACPI Error: Could not remove SCI handler
(20160930/evmisc-281)
>[ 0.184068] kmem_cache_destroy Acpi-Operand: Slab cache still has
objects
>[ 0.185358] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.10.0-rc3 #2
>[ 0.186820] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS
virtual_box 12/01/2006
>[ 0.188000] Call Trace:
>[ 0.188000] ? dump_stack+0x5c/0x7d
>[ 0.188000] ? kmem_cache_destroy+0x224/0x230
>[ 0.188000] ? acpi_sleep_proc_init+0x22/0x22
>[ 0.188000] ? acpi_os_delete_cache+0xa/0xd
>[ 0.188000] ? acpi_ut_delete_caches+0x3f/0x7b
>[ 0.188000] ? acpi_terminate+0x5/0xf
>[ 0.188000] ? acpi_init+0x288/0x32e
>[ 0.188000] ? __class_create+0x4c/0x80
>[ 0.188000] ? video_setup+0x7a/0x7a
>[ 0.188000] ? do_one_initcall+0x4e/0x1b0
>[ 0.188000] ? kernel_init_freeable+0x194/0x21a
>[ 0.188000] ? rest_init+0x80/0x80
>[ 0.188000] ? kernel_init+0xa/0x100
>[ 0.188000] ? ret_from_fork+0x25/0x30
When early abort is occurred due to invalid ACPI information, Linux kernel
terminates ACPI by calling acpi_terminate() function. The function calls
acpi_ns_terminate() function to delete namespace data and ACPI operand cache
(acpi_gbl_module_code_list).
But the deletion code in acpi_ns_terminate() function is wrapped in
ACPI_EXEC_APP definition, therefore the code is only executed when the
definition exists. If the define doesn't exist, ACPI operand cache
(acpi_gbl_module_code_list) is leaked, and stack dump is shown in kernel log.
This causes a security threat because the old kernel (<= 4.9) shows memory
locations of kernel functions in stack dump, therefore kernel ASLR can be
neutralized.
To fix ACPI operand leak for enhancing security, I made a patch which
removes the ACPI_EXEC_APP define in acpi_ns_terminate() function for
executing the deletion code unconditionally.
Link: a23325b2
2017-04-27 00:31:00 +02:00
ACPICA: Namespace: fix operand cache leak
2017-04-27 00:31:00 +02:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>
2017-03-02 08:42:29 +01:00
ahci: qoriq: correct the sata ecc setting error
2017-03-09 11:55:23 -05:00
sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>
2017-03-02 08:42:32 +01:00
auxdisplay: img-ascii-lcd: add missing sentinel entry in img_ascii_lcd_matches
2017-03-16 16:59:55 +09:00
drivers core: remove assert_held_device_hotplug()
2017-03-16 16:56:19 -07:00
nbd: replace kill_bdev() with __invalidate_device()
2017-03-24 15:42:47 -06:00
Bluetooth: btqcomsmd: fix compile-test dependency
2017-03-22 19:22:04 -07:00
Char/Misc driver fixes for 4.11-rc4
2017-03-26 11:15:54 -07:00
Allwinner clock fixes for 4.11
2017-03-23 16:08:46 -07:00
Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2017-04-02 09:22:03 -07:00
Merge branches 'pm-cpufreq-fixes' and 'pm-cpuidle-fixes'
2017-03-31 23:00:53 +02:00
cpuidle: powernv: Pass correct drv->cpumask for registration
2017-03-29 22:55:36 +02:00
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2017-03-31 12:11:32 -07:00
device-dax: fix debug output typo
2017-03-10 19:56:56 -08:00
dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
2017-03-14 10:11:27 +05:30
sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>
2017-03-02 08:42:32 +01:00
EDAC, pnd2_edac: Fix reported DIMM number
2017-03-26 09:36:28 +02:00
extcon: int3496: Set the id pin to direction-input if necessary
2017-03-22 18:29:48 +09:00
efi/esrt: Cleanup bad memory map log messages
2017-03-17 18:53:12 +00:00
ACPI / gpio: do not fall back to parsing _CRS when we get a deferral
2017-03-30 11:08:46 +02:00
Merge branch 'msm-fixes-4.11-rc6' of git://people.freedesktop.org/~robclark/linux into drm-fixes
2017-04-04 10:13:40 +10:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
2017-03-31 11:50:31 -07:00
sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>
2017-03-02 08:42:32 +01:00
Drivers: hv: vmbus: Don't leak memory when a channel is rescinded
2017-03-16 16:42:33 +09:00
hwmon: (asus_atk0110) fix uninitialized data access
2017-03-23 12:01:57 -07:00
intel_th: pci: Add Gemini Lake support
2017-03-15 14:55:18 +02:00
i2c: mux: pca954x: Add missing pca9546 definition to chip_desc
2017-03-24 12:22:18 +01:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>
2017-03-02 08:42:36 +01:00
Power management turbostat utility updates for v4.11-rc1
2017-03-02 17:41:27 -08:00
iio: hid-sensor-attributes: Fix sensor property setting failure.
2017-04-02 11:44:03 +01:00
IB/qib: fix false-postive maybe-uninitialized warning
2017-03-24 22:44:29 -04:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2017-03-23 19:51:06 -07:00
Merge branch 'for-joerg/arm-smmu/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/will/linux into iommu/fixes
2017-03-22 23:59:56 +01:00
irqchip fixes for 4.11-rc5
2017-03-31 16:54:48 +02:00
isdn: kcapi: avoid uninitialized data
2017-03-28 17:59:33 -07:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/loadavg.h>
2017-03-02 08:42:27 +01:00
sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>
2017-03-02 08:42:32 +01:00
powerpc/pmac: Fix crash in dma-mapping.h with NULL dma_ops
2017-03-10 14:17:23 +11:00
sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>
2017-03-02 08:42:32 +01:00
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
2017-04-08 11:56:58 -07:00
media fixes for v4.11-rc4
2017-03-24 13:34:16 -07:00
Linux 4.11-rc1
2017-03-06 08:37:53 -08:00
Char/Misc driver fixes for 4.11-rc4
2017-03-26 11:15:54 -07:00
mmc: sdhci-of-at91: fix MMC_DDR_52 timing selection
2017-03-30 21:10:29 +02:00
scripts/spelling.txt: add "disble(d)" pattern and fix typo instances
2017-03-09 17:01:09 -08:00
nfp: fix potential use after free on xdp prog
2017-04-05 18:46:40 -07:00
nvmet: fix byte swap in nvmet_parse_io_cmd
2017-04-02 10:24:15 +03:00
sched/headers: Prepare to move the get_task_struct()/put_task_struct() and related APIs from <linux/sched.h> to <linux/sched/task.h>
2017-03-02 08:42:40 +01:00
Merge branch 'parisc-4.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux
2017-03-03 16:20:06 -08:00
parport: fix attempt to write duplicate procfiles
2017-03-16 17:32:21 +09:00
PCI: dwc: Fix dw_pcie_ops NULL pointer dereference
2017-04-04 08:24:25 -05:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/clock.h>
2017-03-02 08:42:27 +01:00
phy: qcom-usb-hs: Add depends on EXTCON
2017-03-09 15:29:57 +05:30
pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable()
2017-04-07 01:08:08 +02:00
platform-drivers-x86 for v4.11-2
2017-03-13 13:23:43 -07:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>
2017-03-02 08:42:29 +01:00
PTP: fix ptr_ret.cocci warnings
2017-03-20 16:25:06 +01:00
drivers/rapidio/devices/tsi721.c: make module parameter variable name unique
2017-03-31 17:13:30 -07:00
remoteproc: qcom: fix QCOM_SMD dependencies
2017-03-20 14:45:44 -07:00
virtio, vhost: optimizations, fixes
2017-03-02 13:53:13 -08:00
sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>
2017-03-02 08:42:32 +01:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-04-05 20:17:38 -07:00
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
2017-04-08 11:56:58 -07:00
sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>
2017-03-02 08:42:32 +01:00
sched/headers: Prepare for new header dependencies before moving code to <uapi/linux/sched/types.h>
2017-03-02 08:42:27 +01:00
staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
2017-04-08 12:13:11 +02:00
tcmu: Convert cmd_time_out into backend device attribute
2017-03-18 16:32:30 -07:00
thermal: cpu_cooling: Check OPP for errors
2017-03-13 10:06:55 +08:00
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2017-04-02 09:25:10 -07:00
sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>
2017-03-02 08:42:32 +01:00
usb: phy: isp1301: Fix build warning when CONFIG_OF is disabled
2017-03-29 12:13:50 +02:00
uwb: i1480-dfu: fix NULL-deref at probe
2017-03-14 17:07:31 +08:00
VFIO fixes for v4.11-rc4
2017-03-24 14:39:36 -07:00
vhost-vsock: add pkt cancel capability
2017-03-21 14:41:46 -07:00
sched/headers: Remove the <linux/mm_types.h> dependency from <linux/sched.h>
2017-03-03 01:45:16 +01:00
virtio_balloon: prevent uninitialized variable use
2017-03-28 20:41:28 +03:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>
2017-03-02 08:42:29 +01:00
xenbus: remove transaction holder from list before freeing
2017-04-04 10:11:06 -04:00
3b2d69114f