mirror of
https://github.com/torvalds/linux.git
synced 2026-05-16 10:36:00 +02:00
eddf3e9c7c
The following crash was observed:
Unable to handle kernel NULL pointer dereference at 0000000000000158
Internal error: Oops: 96000004 [#1] SMP
pc : resend_irqs+0x68/0xb0
lr : resend_irqs+0x64/0xb0
...
Call trace:
resend_irqs+0x68/0xb0
tasklet_action_common.isra.6+0x84/0x138
tasklet_action+0x2c/0x38
__do_softirq+0x120/0x324
run_ksoftirqd+0x44/0x60
smpboot_thread_fn+0x1ac/0x1e8
kthread+0x134/0x138
ret_from_fork+0x10/0x18
The reason for this is that the interrupt resend mechanism happens in soft
interrupt context, which is a asynchronous mechanism versus other
operations on interrupts. free_irq() does not take resend handling into
account. Thus, the irq descriptor might be already freed before the resend
tasklet is executed. resend_irqs() does not check the return value of the
interrupt descriptor lookup and derefences the return value
unconditionally.
1):
__setup_irq
irq_startup
check_irq_resend // activate softirq to handle resend irq
2):
irq_domain_free_irqs
irq_free_descs
free_desc
call_rcu(&desc->rcu, delayed_free_desc)
3):
__do_softirq
tasklet_action
resend_irqs
desc = irq_to_desc(irq)
desc->handle_irq(desc) // desc is NULL --> Ooops
Fix this by adding a NULL pointer check in resend_irqs() before derefencing
the irq descriptor.
Fixes:
|
||
|---|---|---|
| .. | ||
| affinity.c | ||
| autoprobe.c | ||
| chip.c | ||
| cpuhotplug.c | ||
| debug.h | ||
| debugfs.c | ||
| devres.c | ||
| dummychip.c | ||
| generic-chip.c | ||
| handle.c | ||
| internals.h | ||
| ipi.c | ||
| irq_sim.c | ||
| irqdesc.c | ||
| irqdomain.c | ||
| Kconfig | ||
| Makefile | ||
| manage.c | ||
| matrix.c | ||
| migration.c | ||
| msi.c | ||
| pm.c | ||
| proc.c | ||
| resend.c | ||
| settings.h | ||
| spurious.c | ||
| timings.c | ||