Bug 1033414

Created attachment 827559 [details]
File: dmesg

Hi Chris,

It seems that commit commit 5f4513864304672e6ea9eac60583eeac32e679f2 has
added the following:
Author: Henrik Rydberg <rydberg>
Date:   Thu Sep 26 08:33:16 2013 +0200

    hwmon: (applesmc) Check key count before proceeding
    
    After reports from Chris and Josh Boyer of a rare crash in applesmc,
    Guenter pointed at the initialization problem fixed below. The patch
    has not been verified to fix the crash, but should be applied
    regardless.
    
    Reported-by: <jwboyer>
    Suggested-by: Guenter Roeck <linux>
    Signed-off-by: Henrik Rydberg <rydberg>
    Cc: stable.org
    Signed-off-by: Guenter Roeck <linux>

diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 62c2e32..98814d1 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -525,16 +525,25 @@ static int applesmc_init_smcreg_try(void)
 {
        struct applesmc_registers *s = &smcreg;
        bool left_light_sensor, right_light_sensor;
+       unsigned int count;
        u8 tmp[1];
        int ret;
 
        if (s->init_complete)
                return 0;
 
-       ret = read_register_count(&s->key_count);
+       ret = read_register_count(&count);
        if (ret)
                return ret;
 
+       if (s->cache && s->key_count != count) {
+               pr_warn("key count changed from %d to %d\n",
+                       s->key_count, count);
+               kfree(s->cache);
+               s->cache = NULL;
+       }
+       s->key_count = count;
+
        if (!s->cache)
                s->cache = kcalloc(s->key_count, sizeof(*s->cache), GFP_KERNEL);
        if (!s->cache)

so now we will try to allocate an insane amount of memory and we will barf:
[    8.603053] applesmc: key count changed from 261 to 1392508929

The issue is that this machine returns 1392508929 on that register so we
try to allocate 1392508929 * sizeof (*s->cache) which obviously fails.

Can you attach the output of dmidecode to this BZ please?

thanks,
Michele

Possibly related to bug 1011719.

Created attachment 828118 [details]
dmidecode

Just a note for anyone seeing this BZ. We discussed this on LKML:
https://lkml.org/lkml/2013/11/24/38

It's an extremely rare one-time off event, so we let it rest for now unless
more people start seeing this

*********** MASS BUG UPDATE **************

We apologize for the inconvenience.  There is a large number of bugs to go through and several of them have gone stale.  Due to this, we are doing a mass bug update across all of the Fedora 20 kernel bugs.

Fedora 20 has now been rebased to 3.13.4-200.fc20.  Please test this kernel update and let us know if you issue has been resolved or if it is still present with the newer kernel.

If you experience different issues, please open a new bug report for those.

*********** MASS BUG UPDATE **************

This bug has been in a needinfo state for several weeks and is being closed with insufficient data due to inactivity. If this is still an issue with Fedora 20, please feel free to reopen the bug and provide the additional information requested.