From patchwork Fri Nov 21 01:02:25 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Suravee Suthikulpanit X-Patchwork-Id: 5352331 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 2C288C11AC for ; Fri, 21 Nov 2014 01:25:22 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5EA6020122 for ; Fri, 21 Nov 2014 01:25:21 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 67D7A2010C for ; Fri, 21 Nov 2014 01:25:20 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1Xrcvh-0007Ca-2Y; Fri, 21 Nov 2014 01:22:33 +0000 Received: from mail-bl2on0121.outbound.protection.outlook.com ([65.55.169.121] helo=na01-bl2-obe.outbound.protection.outlook.com) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1Xrccq-0001lH-6v for linux-arm-kernel@lists.infradead.org; Fri, 21 Nov 2014 01:03:05 +0000 Received: from BN1PR02CA0051.namprd02.prod.outlook.com (10.141.56.51) by BY2PR02MB201.namprd02.prod.outlook.com (10.242.232.12) with Microsoft SMTP Server (TLS) id 15.1.16.15; Fri, 21 Nov 2014 01:02:40 +0000 Received: from BN1AFFO11FD029.protection.gbl (2a01:111:f400:7c10::158) by BN1PR02CA0051.outlook.office365.com (2a01:111:e400:2a::51) with Microsoft SMTP Server (TLS) id 15.1.16.15 via Frontend Transport; Fri, 21 Nov 2014 01:02:40 +0000 Received: from atltwp01.amd.com (165.204.84.221) by BN1AFFO11FD029.mail.protection.outlook.com (10.58.52.184) with Microsoft SMTP Server id 15.1.6.13 via Frontend Transport; Fri, 21 Nov 2014 01:02:39 +0000 X-WSS-ID: 0NFD6WD-07-QQW-02 X-M-MSG: Received: from satlvexedge02.amd.com (satlvexedge02.amd.com [10.177.96.29]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by atltwp01.amd.com (Axway MailGate 5.3.1) with ESMTPS id 2BDE4CAE64F; Thu, 20 Nov 2014 19:02:37 -0600 (CST) Received: from SATLEXDAG04.amd.com (10.181.40.9) by SATLVEXEDGE02.amd.com (10.177.96.29) with Microsoft SMTP Server (TLS) id 14.3.195.1; Thu, 20 Nov 2014 19:03:03 -0600 Received: from ssuthiku-fedora-lt.amd.com (10.180.168.240) by satlexdag04.amd.com (10.181.40.9) with Microsoft SMTP Server id 14.3.195.1; Thu, 20 Nov 2014 20:02:36 -0500 From: To: , Subject: [PATCH] irqdomain: Fix NULL pointer dererence in irq_domain_free_irqs_parent Date: Thu, 20 Nov 2014 19:02:25 -0600 Message-ID: <1416531745-24661-1-git-send-email-suravee.suthikulpanit@amd.com> X-Mailer: git-send-email 1.9.3 MIME-Version: 1.0 X-EOPAttributedMessage: 0 Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) Authentication-Results: spf=none (sender IP is 165.204.84.221) smtp.mailfrom=Suravee.Suthikulpanit@amd.com; X-Forefront-Antispam-Report: CIP:165.204.84.221; CTRY:US; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(428002)(199003)(189002)(46102003)(95666004)(106466001)(120916001)(33646002)(97736003)(62966003)(77096003)(53416004)(64706001)(105586002)(77156002)(93916002)(107046002)(4396001)(20776003)(86362001)(50226001)(87286001)(92726001)(229853001)(47776003)(36756003)(99396003)(21056001)(84676001)(50986999)(88136002)(89996001)(68736004)(50466002)(86152002)(92566001)(101416001)(19580405001)(102836001)(104166001)(44976005)(19580395003)(48376002)(87936001)(31966008); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2PR02MB201; H:atltwp01.amd.com; FPR:; MLV:sfv; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Antispam: UriScan:; X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:BY2PR02MB201; X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:;SRVR:BY2PR02MB201; X-Forefront-PRVS: 0402872DA1 X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:;SRVR:BY2PR02MB201; X-OriginatorOrg: amd4.onmicrosoft.com X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20141120_170304_476009_BB79664D X-CRM114-Status: GOOD ( 10.95 ) X-Spam-Score: -0.0 (/) Cc: marc.zyngier@arm.com, linux-pci@vger.kernel.org, Suravee Suthikulpanit , linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_LOW, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Suravee Suthikulpanit This patch checks if the parent domain is NULL before recursively freeing irqs in the parent domains. In this case, GICv2m is freeing irqs in parent (GIC), which calls irq_domain_free_irqs_top. This fixes the crash below: Unble to handle kernel NULL pointer dereference at virtual address 00000018 pgd = fffffe03c78c0000 [00000018] *pgd=00000083c8700003, *pud=00000083c8700003, *pmd=00000083c8700003, *pte=0000000000000000 Internal error: Oops: 96000007 [#1] SMP Modules linked in: mlx4_core(-) rtc_efi efivarfs [last unloaded: mlx4_en] CPU: 5 PID: 985 Comm: modprobe Not tainted 3.18.0-rc4-marc-v2m+ #223 task: fffffe03c20c0000 ti: fffffe03c1fb8000 task.ti: fffffe03c1fb8000 PC is at irq_domain_free_irqs_recursive+0x10/0x84 LR is at irq_domain_free_irqs_common+0x8c/0xa0 pc : [] lr : [] pstate: 60000145 sp : fffffe03c1fbb9a0 x29: fffffe03c1fbb9a0 x28: fffffe03c1fb8000 x27: fffffe000092f000 x26: fffffe03c10eba00 ... Call trace: [] irq_domain_free_irqs_recursive+0x10/0x84 [] irq_domain_free_irqs_common+0x88/0xa0 [] irq_domain_free_irqs_top+0x6c/0x84 [] irq_domain_free_irqs_recursive+0x24/0x84 [] irq_domain_free_irqs_parent+0x14/0x20 [] gicv2m_irq_domain_free+0x48/0x88 [] irq_domain_free_irqs_recursive+0x24/0x84 [] irq_domain_free_irqs_common+0x88/0xa0 [] irq_domain_free_irqs_top+0x6c/0x84 [] msi_domain_free+0x74/0x8c [] irq_domain_free_irqs_recursive+0x24/0x84 [] irq_domain_free_irqs+0x110/0x184 [] msi_domain_free_irqs+0x28/0x4c [] free_msi_irqs+0x90/0x1d8 [] pci_disable_msix+0x40/0x50 Signed-off-by: Suravee Suthikulpanit --- kernel/irq/irqdomain.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c index 029acf1..4390eb8 100644 --- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -1166,6 +1166,9 @@ int irq_domain_alloc_irqs_parent(struct irq_domain *domain, void irq_domain_free_irqs_parent(struct irq_domain *domain, unsigned int irq_base, unsigned int nr_irqs) { + if (!domain->parent) + return; + /* irq_domain_free_irqs_recursive() will call parent's free */ if (!irq_domain_is_auto_recursive(domain)) irq_domain_free_irqs_recursive(domain->parent, irq_base,