acpi_resource bug?

[Jung-uk Kim]

On Monday 14 February 2011 10:29 am, Matthew Fleming wrote:
> On Mon, Feb 14, 2011 at 6:24 AM, John Baldwin <jhb at freebsd.org> 
wrote:
> > On Sunday, February 13, 2011 2:46:07 pm Matthew Fleming wrote:
> >> I'm not very familiar with the acpi code, but we have seen an
> >> intermittent issue on boot:
> >>
> >> 1) should the length of the bcopy() be changed to either respect
> >> res->Length or the actual length of the ACPI_RESOURCE_DATA for
> >> the type?
> >
> > It should just use res->Length:
>
> Is there a guarantee that res->Length is <= sizeof(ACPI_RESOURCE) ?

No.  Please try the attached patch (after your r218685).

Jung-uk Kim
-------------- next part --------------
Index: sys/dev/acpica/acpi_resource.c
===================================================================
--- sys/dev/acpica/acpi_resource.c	(revision 218686)
+++ sys/dev/acpica/acpi_resource.c	(working copy)
@@ -65,31 +65,30 @@ acpi_lookup_irq_handler(ACPI_RESOURCE *res, void *
 
     switch (res->Type) {
     case ACPI_RESOURCE_TYPE_IRQ:
+	irqnum = res->Data.Irq.InterruptCount;
+	irq = res->Data.Irq.Interrupts[0];
+	len = ACPI_RS_SIZE(ACPI_RESOURCE_IRQ);
+	break;
     case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
-	if (res->Type == ACPI_RESOURCE_TYPE_IRQ) {
-	    irqnum = res->Data.Irq.InterruptCount;
-	    irq = res->Data.Irq.Interrupts[0];
-	} else {
-	    irqnum = res->Data.ExtendedIrq.InterruptCount;
-	    irq = res->Data.ExtendedIrq.Interrupts[0];
-	}
-	if (irqnum != 1)
-	    break;
-	req = (struct lookup_irq_request *)context;
-	if (req->counter != req->rid) {
-	    req->counter++;
-	    break;
-	}
-	req->found = 1;
-	KASSERT(irq == rman_get_start(req->res),
-	    ("IRQ resources do not match"));
-	len = res->Length;
-	if (len > sizeof(ACPI_RESOURCE))
-		len = sizeof(ACPI_RESOURCE);
-	bcopy(res, req->acpi_res, len);
-	return (AE_CTRL_TERMINATE);
+	irqnum = res->Data.ExtendedIrq.InterruptCount;
+	irq = res->Data.ExtendedIrq.Interrupts[0];
+	len = ACPI_RS_SIZE(ACPI_RESOURCE_EXTENDED_IRQ);
+	break;
+    default:
+	return (AE_OK);
     }
-    return (AE_OK);
+    if (irqnum != 1)
+	return (AE_OK);
+    req = (struct lookup_irq_request *)context;
+    if (req->counter != req->rid) {
+	req->counter++;
+	return (AE_OK);
+    }
+    req->found = 1;
+    KASSERT(irq == rman_get_start(req->res),
+	("IRQ resources do not match"));
+    bcopy(res, req->acpi_res, len);
+    return (AE_CTRL_TERMINATE);
 }
 
 ACPI_STATUS