Date: Thu, 25 Nov 2004 11:46:13 +0800 From: Jiawei Ye <leafy7382@gmail.com> To: Kris Kennaway <kris@obsecurity.org>, freebsd-current@freebsd.org Subject: Re: Memory modified after free: Most recently used by acpica Message-ID: <c21e92e2041124194616c3edfd@mail.gmail.com> In-Reply-To: <20041124212855.GA32463@xor.obsecurity.org> References: <20041124212855.GA32463@xor.obsecurity.org>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --]
On Wed, 24 Nov 2004 13:28:55 -0800, Kris Kennaway <kris@obsecurity.org> wrote:
> This happens on fresh 6.0 if I boot with acpi enabled (but not with
> acpi compiled out of the kernel).
>
> Kris
Same here, with my acpidump attached.
Jiawei
--
"Without the userland, the kernel is useless."
--inspired by The Tao of Programming
[-- Attachment #2 --]
DSDT®6 {INTEL BROKDLEG MSFT
APIC
\_PICphAPIC\_PR_[CPU1 \_S0_
\_S1_
\SS3_
\_S4_
\_S5_
AMCTH hi¤
rh
`BUF0`BUF1`phBUF0piBUF1¢`v` BUF0` BUF1` ”¤ ¤4\_SB_[PWRB_HIDAŠ _STA ¤
[+PCI0_HIDAŠ
_UID
_ADR
_BBN
USXD OSFL¤
”¤
CRS_F
¢
’ Gųų
÷ ų
’’ ó
’’ ’’
’’ß’ ąß ąž’’ß’ š’ y [SKPD
Ž
[SKPD SPLVW2FG RTCX[TMEM
c
[TMEMTOMRTOM_
,MDET TOM_” FLAGyTOMR
TOM_”¤ ¤TOM_TFCS tMDETĄ`¤`FLAG
OSFL
M
_INI \/_SB_PCI0IODT 'MCTH\_OS_
Microsoft Windows NT p
OSFL”N $MCTH\_OS_
Microsoft Windows p
OSFL”F :MCTH\_OS_
Microsoft WindowsME: Millennium Edition p
OSFL”p
OSFL_REG h
piFLAG8_CRS CRS_
vTMEMCRS_
TLENpMDETTMEMt ĄžTMEMTLEN¤CRS__PRT
APIC¤PIC2”¤PIC3PIC2A
’’
’’
’’
’’
’’
’’
’’
’’
’’
PIC3I ’’
\._SB_LNKC
’’
\._SB_LNKB
’’
\._SB_LNKA
’’
\._SB_LNKD
’’
\._SB_LNKC
’’
\._SB_LNKH
’’
\._SB_LNKA
’’
\._SB_LNKB
’’
\._SB_LNKA
[AUSB1_ADR USXD OSFL¤
”¤
_PRW
\_GPE_L03 \/_SB_PCI0USB1
[AUSB2_ADR USXD OSFL¤
”¤
_PRW
\_GPE_L04 \/_SB_PCI0USB2
[AUSB3_ADR USXD OSFL¤
”¤
_PRW
\_GPE_L0C \/_SB_PCI0USB3
[;EHCI_ADR _PRW
\_GPE_L0D \/_SB_PCI0EHCI
[DDICHB_ADR _S1D ¤
USXD ¤
_S4D ¤
_PRT
APIC¤PIC0”¤PIC1PIC0E’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
’’
PIC1M$’’
\._SB_LNKA
’’
\._SB_LNKB
’’
\._SB_LNKC
’’
\._SB_LNKD
’’
\._SB_LNKB
’’
\._SB_LNKC
’’
\._SB_LNKD
’’
\._SB_LNKA
’’
\._SB_LNKC
’’
\._SB_LNKD
’’
\._SB_LNKA
’’
\._SB_LNKB
’’
\._SB_LNKD
’’
\._SB_LNKA
’’
\._SB_LNKB
’’
\._SB_LNKC
’’
\._SB_LNKB
’’
\._SB_LNKC
’’
\._SB_LNKD
’’
\._SB_LNKA
’’
\._SB_LNKA
’’
\._SB_LNKB
’’
\._SB_LNKC
’’
\._SB_LNKD
’’
\._SB_LNKE
’’
\._SB_LNKF
’’
\._SB_LNKG
_PRW ¤
\_GPE_L0B \/_SB_PCI0ICHB
[MSBRG_ADR \._SB_IPRS
0#ųÜ8y \._SB_PRSA
0#ųÜ8y \._SB_PRSB
0#ųÜ8y \._SB_PRSC
0#ųÜ8y \._SB_PRSD
0#ųÜ8y \._SB_PRSE
0#ųÜ8y \._SB_PRSF
0#ųÜ8y \._SB_PRSG
0#ųÜ8y \._SB_PRSH
0#ųÜ8y [PIX0
`
[PIX1
h
[LPC0
ą
[LPC1
ģ
@g\_SB_[)\/_SB_PCI0SBRGPIX0PIRAPIRBPIRCPIRD[)\/_SB_PCI0SBRGPIX1PIREPIRFPIRGPIRH[D \/_SB_PCI0SBRGLPC0LPCA LPCB LPLP LPFD LPSB LPMDLPMS GEN1CAENCBENLPENFDENSBENMDENMSENADENGMLEGMHEKBENMCENCF1ECF2E [\/_SB_PCI0SBRGLPC1GEN2BUFA
# y BUFA
IRA0IQ05
0# 8y IQ10
0# 8y IQ11
0# 8y IQ12
0# 8y [HLNKA_HIDAŠ_UID
_STA {PIRA
` `¤
”¤
_PRS ¤PRSA_DIS }PIRA
PIRA_CRS {PIRA
`y
`IRA0¤BUFA_SRSh
IRA_IRA_`v`p`PIRA[HLNKB_HIDAŠ_UID
_STA {PIRB
` `¤
”¤
_PRS ¤PRSB_DIS }PIRB
PIRB_CRS {PIRB
`y
`IRA0¤BUFA_SRSh
IRA_IRA_`v`p`PIRB[HLNKC_HIDAŠ_UID
_STA {PIRC
` `¤
”¤
_PRS ¤PRSC_DIS }PIRC
PIRC_CRS {PIRC
`y
`IRA0¤BUFA_SRSh
IRA_IRA_`v`p`PIRC[I
LNKD_HIDAŠ_UID
_STA {PIRD
` `¤
”¤
L_PRS \/_SB_PCI0OSFL¤PRSD”>
PIRD
¤IQ05
PIRD
¤IQ10
PIRD
¤IQ11
PIRD
¤IQ12¤PRSD_DIS }PIRD
PIRD_CRS {PIRD
`y
`IRA0¤BUFA_SRSh
IRA_IRA_`v`p`PIRD[HLNKE_HIDAŠ_UID
_STA {PIRE
` `¤
”¤
_PRS ¤PRSE_DIS }PIRE
PIRE_CRS {PIRE
`y
`IRA0¤BUFA_SRSh
IRA_IRA_`v`p`PIRE[HLNKF_HIDAŠ_UID
_STA {PIRF
` `¤
”¤
_PRS ¤PRSF_DIS }PIRF
PIRF_CRS {PIRF
`y
`IRA0¤BUFA_SRSh
IRA_IRA_`v`p`PIRF[HLNKG_HIDAŠ_UID
_STA {PIRG
` `¤
”¤
_PRS ¤PRSG_DIS }PIRG
PIRG_CRS {PIRG
`y
`IRA0¤BUFA_SRSh
IRA_IRA_`v`p`PIRGPRU2
0# 8y [I
LNKH_HIDAŠ_UID
_STA {PIRH
` `¤
”¤
L_PRS \/_SB_PCI0OSFL¤PRSH”>
PIRH
¤IQ05
PIRH
¤IQ10
PIRH
¤IQ11
PIRH
¤IQ12¤PRSH_DIS }PIRH
PIRH_CRS {PIRH
`y
`IRA0¤BUFA_SRSh
IRA_IRA_`v`p`PIRH[C SYSR_HIDAŠ_STA OSFL¤
¤
IORGN
ZK K" KD Kb Ke Kr K K K K K K¢ Ką KGšš GŠŠ G @G y _CRS ¤IORG[@
\._SB_MEM__HIDAŠ_STA \/_SB_PCI0OSFL¤
¤
MEM1F
b
` š Ąž ąž °’ š’ y /_CRS MEM1
,TOP1t\/_SB_PCI0MDET TOP1¤MEM1[6PIC__HIDAŠ_STA OSFL¤
¤
_CRS
K K " y [5DMAD_HIDAŠ _CRS
*K K K K K KĄ y [!TMR__HIDAŠ _CRS
K@ " y [!RTC__HIDAŠ _CRS
Kp " y [SPKR_HIDAŠ _CRS
Ka y [!COPR_HIDAŠ_CRS
Kš " y [PSRG Āā
[PSRGPK2EPM2E [BPS2M_HIDAŠ_STA PM2E¤
”¤
M2R0
" y M2R1
K` Kd " y _CRS
PK2E¤M2R0”¤M2R1[EPS2K_HIDAŠ_CIDAŠ_STA PK2E¤
”¤
_CRS
K` Kd " y .PS2K_PRW
#\_GPE_L18 \/_SB_PCI0SBRGPS2K
SPIO
.[WIN1SPIO
[WIN1INDXDATA[CINDXDATA CFG_ LDN_ @ACTRACT1ACT2 HIOAHIOALIOEHIOEL @INTR INT1 DMCH H%GP40 HRGE0RGE1RGE2RGE3RGE4 HOPT1OPT2OPT3OPT4OPT5OPT6OPT7OPT8OPT9OPTA[HWMT
[HWMTHWINHWDT[K
HWINHWDT @ HW40HW41HW42HW43HW44 HW46HW47HW48HW49HW4AHW4BHW4CHW4DHW4EHW4FHW50HW51HW52HW53HW54HW55HW56HW57HW58HW59HW5AHW5BHW5CHW5DHW5EHW5FENFG p
INDXp
INDX
EXFG p
ŖINDXDKPM DWKE
ģDMPM DWKE
Ü&DWKEENFGp
LDN_{OPT7hOPT7p
’OPT4EXFGLDFD
LDU1
LDU2
LDIR
LDLP
LDGM
LDMD
[E FDC0_HIDAŠ _STA FDST¤GSTALDFD¤
&_DIS DDISLDFDENFGpLDFDLDN_p
DMCHEXFG_CRS ¤FCRS_PRS ¤FPRS,_SRSpFDENDENBLDFDENFGpLDFDLDN_p
DMCHEXFG[IUAR1_HIDAŠ_UID
_STA U1ST¤GSTALDU1¤
_DIS DDISLDU1_CRS ¤PCRSLDU1
I_SRSPSRShLDU1pCAENENFG IOAH
IOAL
ųp LPCA”p
LPCA” IOAL
ųpLPCA”p
LPCAEXFG_PRS ¤C1PR[@UAR20_HID ENFGpLDU2LDN_{OPT2
8`EXFG `¤AŠ”¤AŠ_UID
_STA U2ST¤GSTALDU2¤
_DIS DDISLDU2_CRS ¤PCRSLDU2
I_SRSPSRShLDU2pCBENENFG IOAH
IOAL
ųp LPCB”p
LPCB” IOAL
ųpLPCB”p
LPCBEXFG_PRS ¤C2PR[LIRDA_HIDAŠ_STA IRST¤GSTALDIR¤
_DIS DDISLDIRK
_CRS BUF6
G " y BUF6
IOLOBUF6
IOHIBUF6
IORLBUF6
IORHBUF6
IRQMENFGpLDIRLDN_ ACTRp
IOLOp
IOHI”p
IOLOp
IOHIpIOLOIORLpIOHIIORHy
INTRIRQMEXFG¤BUF6_SRSPSRShLDIR_PRS
0G"8y [CLPT__HIDAŠ ;_STA ENFGpLDLPLDN_{OPT1
`EXFG }`{LPST
¤ ”
¤GSTALDLP_DIS DDISLDLP_CRS ¤PCRSLDLP
G_SRSPSRShLDLPpLPENENFG IOAH
IOAL
xp LPLP”p
LPLP”pLPLPEXFG_PRS ¤LPPR[HECP__HIDAŠ4_STA ENFGpLDLPLDN_{OPT1
`EXFG `LPST¤GSTALDLP”¤ _DIS DDISLDLP_CRS ¤ECRSLDLPG_SRSESRShLDLPpLPENENFG IOAH
IOAL
xp LPLP”p
LPLP”pLPLPEXFG_PRS ¤EPRS[JGAME_HIDAа/>_STA ENFGpLDGMLDN_ ACT1EXFG¤
”rIOAHIOAL` `EXFG¤
”EXFG¤ _DIS ENFGpLDGMLDN_p ACT1EXFGE _CRS BUF6
G y BUF6
IOLOBUF6
IOHIBUF6
IORLBUF6
IORHENFGpLDGMLDN_ IOAL
p
IOLOp
IOHI”p
IOLOp
IOHIpIOLOIORLpIOHIIORHEXFG¤BUF6_PRS
0G 0G8y H_SRSh
IOLOh
IOHIENFGpLDGMLDN_ IOLO
p
IOAHp
IOAL”p
IOAHp
IOAL IOAL
pGMLEp GMHE”
p GMLEpGMHEpACT1EXFG[HMIDI_HIDAа>_STA ENFGpLDMDLDN_ ACT2EXFG¤
”rIOEHIOEL` `EXFG¤
”EXFG¤ _DIS ENFGpLDMDLDN_p ACT2EXFGI _CRS BUF6
G " y BUF6
IOLOBUF6
IOHIBUF6
IORLBUF6
IORHBUF6
IRQMENFGpLDMDLDN_pIOEHIOHIpIOELIOLOpIOLOIORLpIOHIIORHy
INTRIRQMEXFG¤BUF6_PRS6
30G00"ø0G "ø0G"ø0G "ø8y D_SRSh
IOLOh
IOHIh
IRQMENFGpLDMDLDN_pIOHIIOEHpIOLOIOEL -IOLO
0IOLO
IOLO
0p LPMD”pLPMDpMDENIRQM`t`
INTRpACT2EXFGFDST
U1ST
U2ST
IRST
LPST
@IODT GSTALDFD
p
FDST GSTALDU1
p
U1ST GSTALDU2
p
U2ST GSTALDIR
p
IRST GSTALDLP
p
LPST8GSTAENFGphLDN_ ACTRp
`” }IOAHIOAL p
`”p
`EXFG¤`DDISENFGphLDN_p ACTREXFGDENBENFGphLDN_pACTREXFGM
PCRSPBUF
IOLOPBUF
IOHIPBUF
IOHLPBUF
IORLPBUF
ALMNPBUF
LENGPBUF
IRQLENFGphLDN_pIOAHIOHIpIOALIOLOpIOHLIORLpiALMN IOLO
¼p
LENG”pjLENGp`y`INTRIRQLEXFG¤PBUFCPSRSh
POLBh
POHBh
PIRQENFGpiLDN_pPOLBIOALpPOHBIOAHPIRQ`t`
INTRpACTREXFGHECRSEBUF
EPLOEBUF
EPHIEBUF
EPHLEBUF
EPRLEBUF
ALM1EBUF
E4LOEBUF
E4RLEBUF
EIRQEBUF
EDMAENFGphLDN_pIOAHEPHIpIOALEPLOpEPHLEPRLrEPHL E4LOpE4LOE4RL EPHL¼pALM1” pALM1p`pINTRay`aEIRQpDMCHa a
p
EDMA”p`y`aEDMAEXFG¤EBUFHESRSh
LOEPh
HIEPh
IRQEh
DMAEENFGpiLDN_pLOEPIOALpHIEPIOAHIRQE`t`
INTR DMAEDMAE`t`
DMCH”p
DMCHpACTREXFGCNBF
ųMUABSENFGphLDN_CNBF
IOLOCNBF
IOHICNBF
IOADpIOALIOLOpIOAHIOHIEXFG¤IOADCSCP
[0URP1 _STA ¤CSCP
_ON_ p
CSCP
_OFF p
CSCP[0URP2 _STA ¤CSCP
_ON_ p
CSCP
_OFF p
CSCP[0FDDP _STA ¤CSCP
_ON_ p
CSCP
_OFF p
CSCP[0LPTP _STA ¤CSCP
_ON_ p
CSCP
_OFF p
CSCPFCRS#
GņņGōōG÷÷"@ * y PBUF
G " y EBUF
GxxGxx" * y FPRS&
#1 GņņGōōG÷÷"@ * 8y C1PRD
@1 Gųų" 0Gųų"0Gųų"0Gčč"0Gčč"8y C2PRD
@1 Gųų" 0Gųų"0Gųų"0Gčč"0Gčč"8y LPPR7
41 Gxx" 0Gxx" 0Gxx" 0G¼¼" 8y EPRSI
„1 GxxGxx" * 0GxxGxx" * 0GxxGxx" * 0G¼¼G¼¼" * 0GxxGxx" * 0GxxGxx" * 0G¼¼G¼¼" * 8y NATA [GŅIDE0_ADR REGF
_REG h
piREGFTIM0H
x
“
š
#
!
p
I
6
'
TMD0
TMD0
PIO0TMD0
DMA0TMD0
PIO1TMD0
DMA1TMD0
CHNF[CFG2
@
[H
CFG2PMPTPSPTPMRI SMPTSSPTSMRI PSRISSRI PM3EPS3ESM3ESS3E PMUT PSUT SMUT SSUT @PM6EPS6ESM6ESS6EPMCRPSCRSMCRSSCR PMAEPSAESMAESSAEGMPT
GMUE
GMUT
GMCR
GSPT
GSUE
GSUT
GSCR
[E%CHN0_ADR
L_GTM yPSCR
a}PMCRa`yPMAE
cyPM6E
d}cdc}PM3EcayPMPT
c}acayPSAE
cyPS6E
d}cdc}PS3EcbyPSPT
c}bcb¤GTM_PMRIaPMUTPSRIbPSUT`N_STMph[1phTMD0yPMAE
cyPM6E
d}cdc}PM3Ec`yPMPT
c}`c`yPSAE
cyPS6E
d}cdc}PS3EcayPSPT
c}acapPMRIGMPTp`GMUEpPMUTGMUTpPMCRGMCRpPSRIGSPTpaGSUEpPSUTGSUTpPSCRGSCRSTM_pGMPTPMRIpGMUE`pGMUTPMUTpGMCRPMCRpGSUEapGSUTPSUTpGSCRPSCR
{`
p
PM3E”p
PM3E
{`
p
PM6E”p
PM6E {`
p
PMAEp
PM6E”p
PMAE
{a
p
PS3E”p
PS3E
{a
p
PS6E”p
PS6E {a
p
PSAEp
PS6E”p
PSAEpGTF_
iATA0pGTF_
jATA1[DRV0_ADR
_GTF ¤RATAATA0[DRV1_ADR
_GTF ¤RATAATA1[E%CHN1_ADR
L_GTM ySSCR
a}SMCRa`ySMAE
cySM6E
d}cdc}SM3EcaySMPT
c}acaySSAE
cySS6E
d}cdc}SS3EcbySSPT
c}bcb¤GTM_SMRIaSMUTSSRIbSSUT`N_STMph[1phTMD0ySMAE
cySM6E
d}cdc}SM3Ec`ySMPT
c}`c`ySSAE
cySS6E
d}cdc}SS3EcaySSPT
c}acapSMRIGMPTp`GMUEpSMUTGMUTpSMCRGMCRpSSRIGSPTpaGSUEpSSUTGSUTpSSCRGSCRSTM_pGMPTSMRIpGMUE`pGMUTSMUTpGMCRSMCRpGSUEapGSUTSSUTpGSCRSSCR
{`
p
SM3E”p
SM3E
{`
p
SM6E”p
SM6E {`
p
SMAEp
SM6E”p
SMAE
{a
p
SS3E”p
SS3E
{a
p
SS6E”p
SS6E {a
p
SSAEp
SS6E”p
SSAEpGTF_
iATA2pGTF_
jATA3[DRV0_ADR
_GTF ¤RATAATA2[DRV1_ADR
_GTF ¤RATAATA3MGTM_p’PIO0p’PIO1p’DMA0p’DMA1p
CHNF REGF”¤TMD0 {i
}CHNF
CHNFpTIM0
h
fpTIM0
f gpgDMA0pgPIO0 {l
}CHNF
CHNFpTIM0
k
fpTIM0
f gpgDMA1pgPIO1 >{i
pje {i
re
e {i
re
epTIM0
e DMA0}CHNF
CHNF >{l
pme {l
re
e {l
re
epTIM0
e DMA1}CHNF
CHNFpTMD0[1¤TMD0@#STM_ REGF”¤TMD0p
GMUEp
GMUTp
GSUEp
GSUT D{CHNF
pTIM0
DMA0
` `
p
`pTIM0
` GMUT}GMUE
GMUE `
}GMUE
GMUE `
{GMUE
żGMUE}GMUE
GMUE”7 5}PIO0’PIO0
${DMA0’DMA0
pDMA0PIO0}GMUE
GMUE D{CHNF
pTIM0
DMA1
` `
p
`pTIM0
` GSUT}GSUE
GSUE `
}GSUE
GSUE `
{GSUE
żGSUE}GSUE
GSUE”7 5}PIO1’PIO1
${DMA1’DMA1
pDMA1PIO1}GSUE
GSUE {CHNF
}GMUE
GMUE {CHNF
}GSUE
GSUE{TIM0
PIO0
`pTIM0
` apaGMPT `
}GMUE
PGMUE{TIM0
PIO1
`pTIM0
` apaGSPT `
}GSUE
PGSUEAT01
ļAT02
AT03
ĘAT04
ATA0
ATA1
ATA2
ATA3
ATAB
ATAB
CMDCLGTFBwCMDC
8`r`
a[ATABa
8CMDXwCMDC
`ATABr`
A001ATABr`
A005phCMDXpiA001pjA005uCMDCB$GTF_
pi[1p
CMDCID49 ID59
ID53
ID63 ID88 IRDY
PIOT
DMAT
Mi i
bIW49pIW49ID49i
jIW53pIW53ID53i
~IW63pIW63ID63i
vIW59pIW59ID59i
°IW88pIW88ID88p
g Hhp
°g{CHNF
IRDY {CHNF
pPIO1PIOT”
pPIO0PIOT '{CHNF
{CHNF
pDMA1DMAT”
pDMA0DMAT”({CHNF
IRDYpPIO0PIOT {CHNF
pDMA0DMAT G{ID53
{ID88 ’ DMATpTIM0
DMAT
a a
p
aGTFBAT01}
@a g”F C{ID63 ’ PIOT{TIM0
PIOT
`}
TIM0
` aGTFBAT01ag 8IRDY{TIM0
PIOT
`}
TIM0
` aGTFBAT01ag” {ID49 GTFBAT01
g ${ID59 {ID59
’ GTFBAT03{ID59
’ gpATAB[1¤ATAB,RATAh
CMDNwCMDN
8`[h
`RETBpRETB[1¤RETB[SMBS_ADR [AC9__ADR [MC9__ADR _PRW
SLPS
[FSLPB_HIDAŠSBEV SLPSSLPB
”SLPB
\_GPE_L1C \/_SB_SLPBSBEV_PRW
G _PTSphDBG8 h
\/_SB_PCI0OSFL
["ø h
¢WAKS[!
Pp
WAKSph\/_SB_PCI0SPLV¢PS1S[!
Pp
PS1Sp
PS1Ep\/_SB_PCI0OSFL\/_SB_PCI0W2FGp
\._SB_SLPSO_WAKyh
DBG8 #h
\/_SB_PCI0DKPM\/_SB_PCI0DMPM &h
\/_SB_PCI0RTCX\._SB_PWRB
["
x -RTCS 'h
\/_SB_PCI0RTCX\._SB_PWRB
["
x”\._SB_PWRB
["
xp
PWBTp
PS1Ep
\/_SB_PCI0W2FGp
\/_SB_PCI0RTCXp
\._SB_SLPS 4h
h
p
’SHSTp
SHCMp
SMD0p
^SMSVp
HSHCRp
’SHST[PMS0
[PMS0
RTCS WAKS PWBT [SMIE0
[SMIE PS1E PS1S [SWIGp
[
SWIGI12C [SMOV
[&SMOVSHST SHCRSHCMSMSVSMD0SMD1[TEMP
[TEMPDBG8[DEB0
[DEB0DBG9
help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?c21e92e2041124194616c3edfd>
