[PATCH 0/1] yeeloong_laptop: Fix the kernel oops caused by using uninitialized variable

[Tom Li]

If ec_read hasn't been called, status will keep an uninitialized value. Then it will be pass to get_event_key_entry(), cause a kernel oops.

[    0.980000] usb 2-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3

[    0.980000] usb 2-4: Product: RTL8187B_WLAN_Adapter

[    0.980000] usb 2-4: Manufacturer: Manufacturer_Realtek

[    0.980000] usb 2-4: SerialNumber: 00e04c000001

[    0.992000] (ffa/6)ec issued command 132 status : 0x9

[    1.504000] (ff8/8)ec issued command 132 status : 0x9

[    1.508000] CPU 0 Unable to handle kernel paging request at virtual address 0000000100000000, epc == 0000000100000000, ra == ffffffff80564994

[    1.508000] Oops[#1]:

[    1.508000] CPU: 0 PID: 34 Comm: irq/10-sci Not tainted 3.15.3-yeeloong-gaizi #2

[    1.508000] task: 98000000bf2b8000 ti: 98000000bf3ac000 task.ti: 98000000bf3ac000

[    1.508000] $ 0   : 0000000000000000 ffffffffcfffffff 0000000100000000 0000000000000000

[    1.508000] $ 4   : 00000000000000c4 0000010800000000 ffffffff809e4948 0000000000004e90

[    1.508000] $ 8   : 98000000bf2b8000 2064657573736920 00000000000000ee 7461747320323331

[    1.508000] $12   : fffffffffffffffe ffffffffffffffe0 0000000000000000 ffffffff809e4948

[    1.508000] $16   : 0000000000000030 0000000000000030 00000000000000c4 ffffffff80a00000

[    1.508000] $20   : ffffffff80280000 ffffffff802782c8 0000000000000001 ffffffff809675d0

[    1.508000] $24   : 0000000000000000 00000000000031b0

[    1.508000] $28   : 98000000bf3ac000 98000000bf3afd80 ffffffff80950000 ffffffff80564994

[    1.508000] Hi    : 0000000000000108

[    1.508000] Lo    : 0000000031aac000

[    1.508000] epc   : 0000000100000000 0x100000000

[    1.508000]     Not tainted

[    1.508000] ra    : ffffffff80564994 sci_irq_handler+0xcc/0x1c8

[    1.508000] Status: 140044e3 KX SX UX KERNEL EXL IE

[    1.508000] Cause : 00008008

[    1.508000] BadVA : 0000000100000000

[    1.508000] PrId  : 00006303 (ICT Loongson-2)

[    1.508000] Modules linked in:

[    1.508000] Process irq/10-sci (pid: 34, threadinfo=98000000bf3ac000, task=98000000bf2b8000, tls=0000000000000000)

[    1.508000] Stack : ffffffff80280000 98000000bf3a8000 ffffffff8095ded0 0000000000000001

          ffffffff8095ded0 ffffffff802782fc ffffffff80280000 ffffffff802782c8

          0000000000000001 0000000000000001 98000000bf3a8000 ffffffff80278680

          0000000000000000 ffffffff80278430 98000000bf3a8080 ffffffff809d0000

          ffffffff808d0000 98000000bf3a8000 ffffffff80278538 98000000bf068780

          98000000bf2b8780 ffffffff80258fd0 0000000000000000 0000000000000000

          98000000bf3a8000 0000000000000000 98000000bf3afe50 98000000bf3afe50

          0000000000000000 98000000bf3afe68 98000000bf3afe68 0000000000000000

          ffffffff80258ef0 98000000bf3a8080 ffffffff809e0000 ffffffff809e0000

          0000000000000000 ffffffff80206ea0 0000000000000000 0000000000000000

          ...

[    1.508000] Call Trace:

[    1.508000] [<ffffffff80280000>] rcu_process_callbacks+0x4d8/0x500

[    1.508000] [<ffffffff802782fc>] irq_thread_fn+0x34/0x78

[    1.508000] [<ffffffff80280000>] rcu_process_callbacks+0x4d8/0x500

[    1.508000] [<ffffffff802782c8>] irq_thread_fn+0x0/0x78

[    1.508000] [<ffffffff80278680>] irq_thread+0x148/0x190

[    1.508000] [<ffffffff80278430>] irq_thread_dtor+0x0/0x108

[    1.508000] [<ffffffff80278538>] irq_thread+0x0/0x190

[    1.508000] [<ffffffff80258fd0>] kthread+0xe0/0xf8

[    1.508000] [<ffffffff80258ef0>] kthread+0x0/0xf8

[    1.508000] [<ffffffff80206ea0>] ret_from_kernel_thread+0x20/0x28

[    1.508000]

Code: (Bad address in epc)

[    1.512000] ---[ end trace d5332affd0d1c32e ]---

[    1.516000] CPU 0 Unable to handle kernel paging request at virtual address ffffffffffffffe0, epc == ffffffff802596c0, ra == ffffffff8027845c

[    1.520000] Oops[#2]:

[    1.520000] CPU: 0 PID: 34 Comm: irq/10-sci Tainted: G      D       3.15.3-yeeloong-gaizi #2

[    1.520000] task: 98000000bf2b8000 ti: 98000000bf3ac000 task.ti: 98000000bf3ac000

[    1.520000] $ 0   : 0000000000000000 ffffffffcfffffff 0000000000000000 98000000bf3afde0

[    1.520000] $ 4   : 98000000bf2b8000 0000000000000000 0000000000000001 0000000000000000

[    1.520000] $ 8   : 0000000000000000 0000000000000000 0000000000000115 0000000000000001

[    1.520000] $12   : 0000000000000000 0000000000000000 0000000000000000 0000000000000000

[    1.520000] $16   : 98000000bf2b8000 98000000bf2b8618 98000000bf2b8000 ffffffff809e0000

[    1.520000] $20   : 0000000000000000 0000000000000060 98000000bf2b8000 0000000000000001

[    1.520000] $24   : 0000000000000000 0000000000000000

[    1.520000] $28   : 98000000bf3ac000 98000000bf3afa70 ffffffff80950000 ffffffff8027845c

[    1.520000] Hi    : 0000000000000108

[    1.520000] Lo    : 0000000031aac000

[    1.520000] epc   : ffffffff802596c0 kthread_data+0x10/0x18

[    1.520000]     Tainted: G      D

[    1.520000] ra    : ffffffff8027845c irq_thread_dtor+0x2c/0x108

[    1.520000] Status: 140044e3 KX SX UX KERNEL EXL IE

[    1.520000] Cause : 80008008

[    1.520000] BadVA : ffffffffffffffe0

[    1.520000] PrId  : 00006303 (ICT Loongson-2)

[    1.520000] Modules linked in:

[    1.520000] Process irq/10-sci (pid: 34, threadinfo=98000000bf3ac000, task=98000000bf2b8000, tls=0000000000000000)

[    1.520000] Stack : 0000000000000000 ffffffff802782c8 000000000000000b 0000000000000000

          98000000bf2b8618 ffffffff8025545c 000000000000000b 000000000000000b

          000000000000000b ffffffff808d60c8 0000000000000000 ffffffff80235fc8

          ffffffff80950000 ffffffff80631f14 98000000bf3afb08 0000000000000000

          0000000000000001 ffffffff802350ac 98000000bf3afc50 000000000000000b

          ffffffff808d60c8 0000000000000000 ffffffff80280000 ffffffff802782c8

          0000000000000001 98000000bf3afc50 ffffffff80950000 ffffffff8020cc84

          0000000100000000 0000000000000000 98000000bf2b8000 ffffffff8021c968

          00030001bf3ac000 ffffffff809df420 ffffffffffff0000 0000000000000000

          0000000000000002 ffffffff80239bc8 000000000000000a 00000000fffff7b6

          ...

[    1.520000] Call Trace:

[    1.520000] [<ffffffff802596c0>] kthread_data+0x10/0x18

[    1.520000] [<ffffffff8027845c>] irq_thread_dtor+0x2c/0x108

[    1.520000] [<ffffffff8025545c>] task_work_run+0xac/0x120

[    1.520000] [<ffffffff80235fc8>] do_exit+0x290/0x9b8

[    1.520000] [<ffffffff8020cc84>] die+0x13c/0x188

[    1.520000] [<ffffffff8021c968>] __do_page_fault+0x3b8/0x430

[    1.520000] [<ffffffff80206dc4>] resume_userspace_check+0x0/0x10

[    1.520000]

Code: 3c01cfff  3421ffff  03e1f824 <03e00008> dc42ffe0  67bdffe0  24060008  ffbf0018  dc850290

[    1.524000] ---[ end trace d5332affd0d1c32f ]---

The below patch fixes it.

diff -uprN linux-3.15/drivers/platform/mips/yeeloong_laptop.c linux-3.15-fix-fn/drivers/platform/mips/yeeloong_laptop.c

--- linux-3.15/drivers/platform/mips/yeeloong_laptop.c  2014-07-03 07:44:30.467523711 +0800

+++ linux-3.15-fix-fn/drivers/platform/mips/yeeloong_laptop.c   2014-07-03 07:50:01.430236919 +0800

@@ -978,7 +978,7 @@ static const struct sci_event se[] = {

 static void do_event_action(int event)

 {

-       int status;

+       int status = -1;

        struct key_entry *ke;

        struct sci_event *sep;

@@ -987,6 +987,11 @@ static void do_event_action(int event)

        if (sep->reg != 0)

                status = ec_read(sep->reg);

+       if (status = -1) {

+               /* ec_read hasn't been called, status is invalid */

+               return;

+       }

+

        if (sep->handler != NULL)

                status = sep->handler(status);

[liu shiwei]

非常好！very good!

--
You received this message because you are subscribed to the Google Groups "loongson-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to loongson-dev...@googlegroups.com.
To post to this group, send email to loongs...@googlegroups.com.
Visit this group at http://groups.google.com/group/loongson-dev.
For more options, visit https://groups.google.com/d/optout.

[Wu Zhangjin]

Thanks, Huacai有空把patch合并进去么？

[Tom Li]

我曾经向这个邮件列表发了三个 patch，有一个是年初发的。这个补丁系列的 0/1 和 1/1 是前几天发的，希望都能合并进去。

感谢各位。

> You received this message because you are subscribed to a topic in the
> Google Groups "loongson-dev" group.
> To unsubscribe from this topic, visit
> https://groups.google.com/d/topic/loongson-dev/AnQjrZ-Xo2I/unsubscribe.
> To unsubscribe from this group and all its topics, send an email to

[Huacai Chen]

我建议直接往kernel.org发吧，loongson-dev用来讨论问题就好，最终还是要往kernel.org去。

[Tom Li]

这些龙芯电脑相关的设备驱动从来就不在主线，一直在 linux-loongson-community.git
里啊。看来在这里讨论合并的事情是无益的，我直接找 Alexandre Oliva 好了……

[Huacai Chen]

这个龙芯社区...就像你说的，比较的半死不活。
严格来说，应该是爱好者的补丁先集成到 linux-loongson-community.git，然后由
linux-loongson-community.git的维护者推送到主线。
但现在 linux-loongson-community.git的维护者已经不在龙芯了....
所以，这个地方就讨论补丁本身的有效性和质量问题吧，至于合并，直接找 Alexandre Oliva更靠谱....

[Wu Zhangjin]

现在是Alexandre Oliva在维护，如果Lemote有开发者有时间，也可以直接参与进来维护。

[Tom Li]

不用管这个补丁了，我已经和 Alexandre Oliva 沟通了一周了。