mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/drivers/hv
History
Maciej S. Szmigiero 96db43aced Drivers: hv: vmbus: Don't dereference ACPI root object handle 
[ Upstream commit 78e04bbff8 ]

Since the commit referenced in the Fixes: tag below the VMBus client driver
is walking the ACPI namespace up from the VMBus ACPI device to the ACPI
namespace root object trying to find Hyper-V MMIO ranges.

However, if it is not able to find them it ends trying to walk resources of
the ACPI namespace root object itself.
This object has all-ones handle, which causes a NULL pointer dereference
in the ACPI code (from dereferencing this pointer with an offset).

This in turn causes an oops on boot with VMBus host implementations that do
not provide Hyper-V MMIO ranges in their VMBus ACPI device or its
ancestors.
The QEMU VMBus implementation is an example of such implementation.

I guess providing these ranges is optional, since all tested Windows
versions seem to be able to use VMBus devices without them.

Fix this by explicitly terminating the lookup at the ACPI namespace root
object.

Note that Linux guests under KVM/QEMU do not use the Hyper-V PV interface
by default - they only do so if the KVM PV interface is missing or
disabled.

Example stack trace of such oops:
[ 3.710827] ? __die+0x1f/0x60
[ 3.715030] ? page_fault_oops+0x159/0x460
[ 3.716008] ? exc_page_fault+0x73/0x170
[ 3.716959] ? asm_exc_page_fault+0x22/0x30
[ 3.717957] ? acpi_ns_lookup+0x7a/0x4b0
[ 3.718898] ? acpi_ns_internalize_name+0x79/0xc0
[ 3.720018] acpi_ns_get_node_unlocked+0xb5/0xe0
[ 3.721120] ? acpi_ns_check_object_type+0xfe/0x200
[ 3.722285] ? acpi_rs_convert_aml_to_resource+0x37/0x6e0
[ 3.723559] ? down_timeout+0x3a/0x60
[ 3.724455] ? acpi_ns_get_node+0x3a/0x60
[ 3.725412] acpi_ns_get_node+0x3a/0x60
[ 3.726335] acpi_ns_evaluate+0x1c3/0x2c0
[ 3.727295] acpi_ut_evaluate_object+0x64/0x1b0
[ 3.728400] acpi_rs_get_method_data+0x2b/0x70
[ 3.729476] ? vmbus_platform_driver_probe+0x1d0/0x1d0 [hv_vmbus]
[ 3.730940] ? vmbus_platform_driver_probe+0x1d0/0x1d0 [hv_vmbus]
[ 3.732411] acpi_walk_resources+0x78/0xd0
[ 3.733398] vmbus_platform_driver_probe+0x9f/0x1d0 [hv_vmbus]
[ 3.734802] platform_probe+0x3d/0x90
[ 3.735684] really_probe+0x19b/0x400
[ 3.736570] ? __device_attach_driver+0x100/0x100
[ 3.737697] __driver_probe_device+0x78/0x160
[ 3.738746] driver_probe_device+0x1f/0x90
[ 3.739743] __driver_attach+0xc2/0x1b0
[ 3.740671] bus_for_each_dev+0x70/0xc0
[ 3.741601] bus_add_driver+0x10e/0x210
[ 3.742527] driver_register+0x55/0xf0
[ 3.744412] ? 0xffffffffc039a000
[ 3.745207] hv_acpi_init+0x3c/0x1000 [hv_vmbus]

Fixes: 7f163a6fd9 ("drivers:hv: Modify hv_vmbus to search for all MMIO ranges available.")
Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Link: https://lore.kernel.org/r/fd8e64ceeecfd1d95ff49021080cf699e88dbbde.1691606267.git.maciej.szmigiero@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2023-09-13 09:42:59 +02:00
..
Kconfig hv: utils: add PTP_1588_CLOCK to Kconfig to fix build 2021-11-28 21:22:35 +00:00
Makefile
…
channel.c Drivers: hv: vmbus: Introduce {lock,unlock}_requestor() 2022-04-25 15:51:13 +00:00
channel_mgmt.c Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs 2023-06-28 11:12:23 +02:00
connection.c Drivers: vmbus: Check for channel allocation before looking up relids 2023-04-13 16:55:18 +02:00
hv.c
…
hv_balloon.c HV: hv_balloon: fix memory leak with using debugfs_lookup() 2023-02-09 11:28:21 +01:00
hv_common.c hyperv-fixes for 5.18-rc2 2022-04-07 06:35:34 -10:00
hv_debugfs.c
…
hv_fcopy.c Drivers: hv: remove duplicate word in a comment 2022-09-05 16:28:40 +00:00
hv_kvp.c Drivers: hv: Fix syntax errors in comments 2022-06-08 12:26:28 +00:00
hv_snapshot.c hv_utils: Add comment about max VMbus packet size in VSS driver 2022-02-18 13:08:18 +00:00
hv_trace.c
…
hv_trace.h
…
hv_trace_balloon.h
…
hv_util.c
…
hv_utils_transport.c Drivers: hv: utils: Make use of the helper macro LIST_HEAD() 2022-02-09 14:33:21 +00:00
hv_utils_transport.h
…
hyperv_vmbus.h Drivers: hv: vm_bus: Handle vmbus rescind calls after vmbus is suspended 2022-07-11 18:53:42 +00:00
ring_buffer.c video: hyperv_fb: Avoid taking busy spinlock on panic path 2022-12-31 13:32:56 +01:00
vmbus_drv.c Drivers: hv: vmbus: Don't dereference ACPI root object handle 2023-09-13 09:42:59 +02:00