rpms/kernel/F-12 wmi-check-find_guid-return-value-to-prevent-oops.patch, NONE, 1.1 wmi-check-wmi-get-event-data-return-value.patch, NONE, 1.1 wmi-free-the-allocated-acpi-objects.patch, NONE, 1.1 wmi-survive-bios-with-duplicate-guids.patch, NONE, 1.1 kernel.spec, 1.1963, 1.1964 linux-2.6-autoload-wmi.patch, 1.1, 1.2

Chuck Ebbert cebbert at fedoraproject.org
Wed Jan 6 02:34:06 UTC 2010


Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-12
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv21112

Modified Files:
	kernel.spec linux-2.6-autoload-wmi.patch 
Added Files:
	wmi-check-find_guid-return-value-to-prevent-oops.patch 
	wmi-check-wmi-get-event-data-return-value.patch 
	wmi-free-the-allocated-acpi-objects.patch 
	wmi-survive-bios-with-duplicate-guids.patch 
Log Message:
Fix WMI driver oopses and a memory leak.

wmi-check-find_guid-return-value-to-prevent-oops.patch:
 wmi.c |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

--- NEW FILE wmi-check-find_guid-return-value-to-prevent-oops.patch ---
From: Paul Rolland <rol at as2917.net>
Date: Wed, 30 Dec 2009 06:19:12 +0000 (-0500)
Subject: wmi: check find_guid() return value to prevent oops
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=b58454ec25e80fdb84e294758aeb22dd6d5ee6f9

wmi: check find_guid() return value to prevent oops

Signed-off-by: rol at as2917.net <Paul Rolland>
Signed-off-by: Len Brown <len.brown at intel.com>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
---

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 9f93d6c..cc9ad74 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -492,8 +492,7 @@ wmi_notify_handler handler, void *data)
 	if (!guid || !handler)
 		return AE_BAD_PARAMETER;
 
-	find_guid(guid, &block);
-	if (!block)
+	if (!find_guid(guid, &block))
 		return AE_NOT_EXIST;
 
 	if (block->handler)
@@ -521,8 +520,7 @@ acpi_status wmi_remove_notify_handler(const char *guid)
 	if (!guid)
 		return AE_BAD_PARAMETER;
 
-	find_guid(guid, &block);
-	if (!block)
+	if (!find_guid(guid, &block))
 		return AE_NOT_EXIST;
 
 	if (!block->handler)

wmi-check-wmi-get-event-data-return-value.patch:
 dell-wmi.c |    7 ++++++-
 hp-wmi.c   |    7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

--- NEW FILE wmi-check-wmi-get-event-data-return-value.patch ---
From: Len Brown <len.brown at intel.com>
Date: Sun, 27 Dec 2009 04:02:24 +0000 (-0500)
Subject: dell-wmi, hp-wmi, msi-wmi: check wmi_get_event_data() return value
X-Git-Tag: v2.6.33-rc3~32^2~4^2~3
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=fda11e61ff8a4e3a8ebbd434e46560b67cc0ca9d

dell-wmi, hp-wmi, msi-wmi: check wmi_get_event_data() return value

[ backport to 2.6.32 ]

When acpi_evaluate_object() is passed ACPI_ALLOCATE_BUFFER,
the caller must kfree the returned buffer if AE_OK is returned.

The callers of wmi_get_event_data() pass ACPI_ALLOCATE_BUFFER,
and thus must check its return value before accessing
or kfree() on the buffer.

Signed-off-by: Len Brown <len.brown at intel.com>
---

diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 4c7e702..500af8c 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -202,8 +202,13 @@ static void dell_wmi_notify(u32 value, void *context)
 	struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
 	static struct key_entry *key;
 	union acpi_object *obj;
+	acpi_status status;
 
-	wmi_get_event_data(value, &response);
+	status = wmi_get_event_data(value, &response);
+	if (status != AE_OK) {
+		printk(KERN_INFO "dell-wmi: bad event status 0x%x\n", status);
+		return;
+	}
 
 	obj = (union acpi_object *)response.pointer;
 
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 18bf741..5b648f0 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -338,8 +338,13 @@ static void hp_wmi_notify(u32 value, void *context)
 	struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
 	static struct key_entry *key;
 	union acpi_object *obj;
+	acpi_status status;
 
-	wmi_get_event_data(value, &response);
+	status = wmi_get_event_data(value, &response);
+	if (status != AE_OK) {
+		printk(KERN_INFO "hp-wmi: bad event status 0x%x\n", status);
+		return;
+	}
 
 	obj = (union acpi_object *)response.pointer;
 

wmi-free-the-allocated-acpi-objects.patch:
 dell-wmi.c |    1 +
 hp-wmi.c   |    2 ++
 wmi.c      |    4 ++--
 3 files changed, 5 insertions(+), 2 deletions(-)

--- NEW FILE wmi-free-the-allocated-acpi-objects.patch ---
From: Anisse Astier <anisse at astier.eu>
Date: Fri, 4 Dec 2009 09:10:09 +0000 (+0100)
Subject: wmi: Free the allocated acpi objects through wmi_get_event_data
X-Git-Tag: v2.6.33-rc2~3^2^2~3
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=3e9b988e4edf065d39c1343937f717319b1c1065

wmi: Free the allocated acpi objects through wmi_get_event_data

[ backported to 2.6.32 ]

These function allocate an acpi object by calling wmi_get_event_data, which
then calls acpi_evaluate_object, and it is not freed afterwards.

And kernel doc is fixed for parameters of wmi_get_event_data.

Signed-off-by: Anisse Astier <anisse at astier.eu>
Acked-by: Randy Dunlap <randy.dunlap at oracle.com>
Acked-by: Carlos Corbacho <carlos at strangeworlds.co.uk>
Signed-off-by: Len Brown <len.brown at intel.com>
---

diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 67f3fe7..6561dfc 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -238,6 +238,7 @@ static void dell_wmi_notify(u32 value, void *context)
 			printk(KERN_INFO "dell-wmi: Unknown key %x pressed\n",
 			       buffer[1] & 0xFFFF);
 	}
+	kfree(obj);
 }
 
 
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 63c3e65..db10c5d 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -381,6 +381,8 @@ static void hp_wmi_notify(u32 value, void *context)
 			       eventcode);
 	} else
 		printk(KERN_INFO "HP WMI: Unknown response received\n");
+
+	kfree(obj);
 }
 
 static int __init hp_wmi_input_setup(void)
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index e425a86..9f93d6c 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -540,8 +540,8 @@ EXPORT_SYMBOL_GPL(wmi_remove_notify_handler);
 /**
  * wmi_get_event_data - Get WMI data associated with an event
  *
- * @event - Event to find
- * &out - Buffer to hold event data
+ * @event: Event to find
+ * @out: Buffer to hold event data. out->pointer should be freed with kfree()
  *
  * Returns extra data associated with an event in WMI.
  */

wmi-survive-bios-with-duplicate-guids.patch:
 wmi.c |   30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

--- NEW FILE wmi-survive-bios-with-duplicate-guids.patch ---
From: Carlos Corbacho <carlos at strangeworlds.co.uk>
Date: Sat, 26 Dec 2009 19:14:59 +0000 (+0000)
Subject: ACPI: WMI: Survive BIOS with duplicate GUIDs
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=d1f9e4970742bb1e22d07b01bd44f9c357d25c42

ACPI: WMI: Survive BIOS with duplicate GUIDs

It would appear that in BIOS's with nVidia hooks, the GUID
05901221-D566-11D1-B2F0-00A0C9062910 is duplicated. For now, the simplest
solution is to just ignore any duplicate GUIDs. These particular hooks are not
currently supported/ used in the kernel, so whoever does that can figure out
what the 'right' solution should be (if there's a better one).

http://bugzilla.kernel.org/show_bug.cgi?id=14846

Signed-off-by: Carlos Corbacho <carlos at strangeworlds.co.uk>
Reported-by: Larry Finger <Larry.Finger at lwfinger.net>
Reported-by: Oldřich Jedlička <oldium.pro at seznam.cz>
Signed-off-by: Len Brown <len.brown at intel.com>
---

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index cc9ad74..b104302 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -714,6 +714,22 @@ static int wmi_class_init(void)
 	return ret;
 }
 
+static bool guid_already_parsed(const char *guid_string)
+{
+	struct guid_block *gblock;
+	struct wmi_block *wblock;
+	struct list_head *p;
+
+	list_for_each(p, &wmi_blocks.list) {
+		wblock = list_entry(p, struct wmi_block, list);
+		gblock = &wblock->gblock;
+
+		if (strncmp(gblock->guid, guid_string, 16) == 0)
+			return true;
+	}
+	return false;
+}
+
 /*
  * Parse the _WDG method for the GUID data blocks
  */
@@ -723,6 +739,7 @@ static __init acpi_status parse_wdg(acpi_handle handle)
 	union acpi_object *obj;
 	struct guid_block *gblock;
 	struct wmi_block *wblock;
+	char guid_string[37];
 	acpi_status status;
 	u32 i, total;
 
@@ -745,6 +762,19 @@ static __init acpi_status parse_wdg(acpi_handle handle)
 	memcpy(gblock, obj->buffer.pointer, obj->buffer.length);
 
 	for (i = 0; i < total; i++) {
+		/*
+		  Some WMI devices, like those for nVidia hooks, have a
+		  duplicate GUID. It's not clear what we should do in this
+		  case yet, so for now, we'll just ignore the duplicate.
+		  Anyone who wants to add support for that device can come
+		  up with a better workaround for the mess then.
+		*/
+		if (guid_already_parsed(gblock[i].guid) == true) {
+			wmi_gtoa(gblock[i].guid, guid_string);
+			printk(KERN_INFO PREFIX "Skipping duplicate GUID %s\n",
+				guid_string);
+			continue;
+		}
 		wblock = kzalloc(sizeof(struct wmi_block), GFP_KERNEL);
 		if (!wblock)
 			return AE_NO_MEMORY;


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-12/kernel.spec,v
retrieving revision 1.1963
retrieving revision 1.1964
diff -u -p -r1.1963 -r1.1964
--- kernel.spec	5 Jan 2010 11:08:25 -0000	1.1963
+++ kernel.spec	6 Jan 2010 02:34:06 -0000	1.1964
@@ -637,6 +637,9 @@ Patch304: linux-2.6-usb-uvc-autosuspend.
 Patch305: linux-2.6-fix-btusb-autosuspend.patch
 
 Patch310: linux-2.6-autoload-wmi.patch
+# wmi autoload fixes
+Patch311: wmi-check-find_guid-return-value-to-prevent-oops.patch
+Patch312: wmi-survive-bios-with-duplicate-guids.patch
 
 Patch340: linux-2.6-debug-vm-would-have-oomkilled.patch
 Patch360: linux-2.6-debug-always-inline-kzalloc.patch
@@ -726,6 +729,10 @@ Patch12010: linux-2.6-dell-laptop-rfkill
 Patch12011: linux-2.6-block-silently-error-unsupported-empty-barriers-too.patch
 Patch12013: linux-2.6-rfkill-all.patch
 
+# Patches for -stable
+Patch12101: wmi-free-the-allocated-acpi-objects.patch
+Patch12102: wmi-check-wmi-get-event-data-return-value.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1206,6 +1213,9 @@ ApplyPatch linux-2.6-fix-btusb-autosuspe
 
 # WMI
 ApplyPatch linux-2.6-autoload-wmi.patch
+# autoload fixes
+ApplyPatch wmi-check-find_guid-return-value-to-prevent-oops.patch
+ApplyPatch wmi-survive-bios-with-duplicate-guids.patch
 
 # ACPI
 ApplyPatch linux-2.6-defaults-acpi-video.patch
@@ -1340,6 +1350,10 @@ ApplyPatch linux-2.6-silence-acpi-blackl
 # Patches headed upstream
 ApplyPatch linux-2.6-rfkill-all.patch
 
+# Patches for -stable
+ApplyPatch wmi-free-the-allocated-acpi-objects.patch
+ApplyPatch wmi-check-wmi-get-event-data-return-value.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -1995,6 +2009,9 @@ fi
 # and build.
 
 %changelog
+* Tue Jan 05 2010 Chuck Ebbert <cebbert at redhat.com>  2.6.32.2-4
+- Fix WMI driver oopses and a memory leak.
+
 * Tue Jan 05 2010 Chuck Ebbert <cebbert at redhat.com>  2.6.32.2-3
 - Run 'make release', fix up tracing options to match what shipped
   in F-12, fix CPU count on x86-64.

linux-2.6-autoload-wmi.patch:
 wmi.c |  175 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 173 insertions(+), 2 deletions(-)

Index: linux-2.6-autoload-wmi.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-12/linux-2.6-autoload-wmi.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -p -r1.1 -r1.2
--- linux-2.6-autoload-wmi.patch	4 Jan 2010 15:44:12 -0000	1.1
+++ linux-2.6-autoload-wmi.patch	6 Jan 2010 02:34:06 -0000	1.2
@@ -1,3 +1,11 @@
+From: Matthew Garrett <mjg at redhat.com>
+Date: Wed, 4 Nov 2009 19:17:53 +0000 (-0500)
+Subject: wmi: Add support for module autoloading
+X-Git-Tag: v2.6.33-rc1~47^2~5^2
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=1caab3c1a90be3aa4ec3599409d8fe044b077478
+
+wmi: Add support for module autoloading
+
 WMI provides interface-specific GUIDs that are exported from modules as
 modalises, but the core currently generates no events to trigger module
 loading. This patch adds support for registering devices for each WMI GUID
@@ -6,9 +14,10 @@ and generating the appropriate uevent.
 Based heavily on a patch by Carlos Corbacho (<carlos at strangeworlds.co.uk>).
 
 Signed-off-by: Matthew Garrett <mjg at redhat.com>
+Tested-by: Carlos Corbacho <carlos at strangeworlds.co.uk>
+Acked-by: Carlos Corbacho <carlos at strangeworlds.co.uk>
+Signed-off-by: Len Brown <len.brown at intel.com>
 ---
- drivers/platform/x86/wmi.c |  175 +++++++++++++++++++++++++++++++++++++++++++-
- 1 files changed, 173 insertions(+), 2 deletions(-)
 
 diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
 index 177f8d7..e425a86 100644
@@ -233,11 +242,3 @@ index 177f8d7..e425a86 100644
  	acpi_bus_unregister_driver(&acpi_wmi_driver);
  
  	list_for_each_safe(p, tmp, &wmi_blocks.list) {
--- 
-1.6.5.2
-
---
-To unsubscribe from this list: send the line "unsubscribe linux-acpi" in
-the body of a message to majordomo at vger.kernel.org
-More majordomo info at  http://vger.kernel.org/majordomo-info.html
-




More information about the fedora-extras-commits mailing list