NetBSD Problem Report #46872
From Wolfgang.Stukenbrock@nagler-company.com Wed Aug 29 14:31:10 2012
Return-Path: <Wolfgang.Stukenbrock@nagler-company.com>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
by www.NetBSD.org (Postfix) with ESMTP id 9E5F063B86D
for <gnats-bugs@gnats.NetBSD.org>; Wed, 29 Aug 2012 14:31:10 +0000 (UTC)
Message-Id: <20120829143055.A89D51E80A9@test-s0.nagler-company.com>
Date: Wed, 29 Aug 2012 16:30:55 +0200 (CEST)
From: Wolfgang.Stukenbrock@nagler-company.com
Reply-To: Wolfgang.Stukenbrock@nagler-company.com
To: gnats-bugs@gnats.NetBSD.org
Subject: mtrr_i686.c may access uninitialized data
X-Send-Pr-Version: 3.95
>Number: 46872
>Category: kern
>Synopsis: mtrr_i686.c may access uninitialized data
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Wed Aug 29 14:35:00 +0000 2012
>Originator: Wolfgang Stukenbrock
>Release: NetBSD 5_1_STABLE - current is affected too
>Organization:
Dr. Nagler & Company GmbH
>Environment:
System: NetBSD test-s0 4.0 NetBSD 4.0 (NSW-WS) #0: Tue Aug 17 17:28:09 CEST 2010 wgstuken@test-s0:/usr/src/sys/arch/amd64/compile/NSW-WS amd64
Architecture: x86_64
Machine: amd64
>Description:
The kernel uses a static allocated array "mttr_raw[]" that is initialized with some default values.
In i686_mtrr_init_first() the message is printed if the actual CPU has more MTRR's as supported.
In i686_raw2soft() there is a loop with the actual number of MTRR's that accesses an allocated array
of the correct size, but it also accesses "mttr_raw[]" via the pointer "mtrr_var_raw" that is initialized
with "mtrr_var_raw = &mtrr_raw[0];"
If there are more MTRR's as supported, the "other" entries in "mttr_raw[]" are accesed or if there are much
more MTRR's, we access memory behind the array.
I've not looked if there are even more places where this happens.
>How-To-Repeat:
I've a crash during boot and saw the messages that there are too much MTRR's for the kernel.
Then I've looked into the sources. I do not know if this is related or not, but it is a bug in any case.
>Fix:
Not known, because I do not know much about the MTRR's - sorry.
If possible, eliminate the static array and do a complete dynamic initialisation. A comment in mttr.h assumes,
that there may be up to 255 MTRR's on a CPU.
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.39 2013/11/01 18:47:49 spz Exp $
$NetBSD: gnats_config.sh,v 1.8 2006/05/07 09:23:38 tsutsui Exp $
Copyright © 1994-2007
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.