From patchwork Fri Nov 21 01:02:25 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Suravee Suthikulpanit X-Patchwork-Id: 5351991 X-Patchwork-Delegate: bhelgaas@google.com Return-Path: X-Original-To: patchwork-linux-pci@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id D3A339F2F1 for ; Fri, 21 Nov 2014 01:02:49 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E7DCC200C6 for ; Fri, 21 Nov 2014 01:02:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4604720160 for ; Fri, 21 Nov 2014 01:02:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756700AbaKUBCo (ORCPT ); Thu, 20 Nov 2014 20:02:44 -0500 Received: from mail-bl2on0145.outbound.protection.outlook.com ([65.55.169.145]:15434 "EHLO na01-bl2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1756487AbaKUBCn (ORCPT ); Thu, 20 Nov 2014 20:02:43 -0500 Received: from BN1PR02CA0051.namprd02.prod.outlook.com (10.141.56.51) by BY2PR02MB201.namprd02.prod.outlook.com (10.242.232.12) with Microsoft SMTP Server (TLS) id 15.1.16.15; Fri, 21 Nov 2014 01:02:40 +0000 Received: from BN1AFFO11FD029.protection.gbl (2a01:111:f400:7c10::158) by BN1PR02CA0051.outlook.office365.com (2a01:111:e400:2a::51) with Microsoft SMTP Server (TLS) id 15.1.16.15 via Frontend Transport; Fri, 21 Nov 2014 01:02:40 +0000 Received: from atltwp01.amd.com (165.204.84.221) by BN1AFFO11FD029.mail.protection.outlook.com (10.58.52.184) with Microsoft SMTP Server id 15.1.6.13 via Frontend Transport; Fri, 21 Nov 2014 01:02:39 +0000 X-WSS-ID: 0NFD6WD-07-QQW-02 X-M-MSG: Received: from satlvexedge02.amd.com (satlvexedge02.amd.com [10.177.96.29]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by atltwp01.amd.com (Axway MailGate 5.3.1) with ESMTPS id 2BDE4CAE64F; Thu, 20 Nov 2014 19:02:37 -0600 (CST) Received: from SATLEXDAG04.amd.com (10.181.40.9) by SATLVEXEDGE02.amd.com (10.177.96.29) with Microsoft SMTP Server (TLS) id 14.3.195.1; Thu, 20 Nov 2014 19:03:03 -0600 Received: from ssuthiku-fedora-lt.amd.com (10.180.168.240) by satlexdag04.amd.com (10.181.40.9) with Microsoft SMTP Server id 14.3.195.1; Thu, 20 Nov 2014 20:02:36 -0500 From: To: , CC: , , , , "Suravee Suthikulpanit" Subject: [PATCH] irqdomain: Fix NULL pointer dererence in irq_domain_free_irqs_parent Date: Thu, 20 Nov 2014 19:02:25 -0600 Message-ID: <1416531745-24661-1-git-send-email-suravee.suthikulpanit@amd.com> X-Mailer: git-send-email 1.9.3 MIME-Version: 1.0 X-EOPAttributedMessage: 0 Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) Authentication-Results: spf=none (sender IP is 165.204.84.221) smtp.mailfrom=Suravee.Suthikulpanit@amd.com; X-Forefront-Antispam-Report: CIP:165.204.84.221; CTRY:US; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(428002)(199003)(189002)(46102003)(95666004)(106466001)(120916001)(33646002)(97736003)(62966003)(77096003)(53416004)(64706001)(105586002)(77156002)(93916002)(107046002)(4396001)(20776003)(86362001)(50226001)(87286001)(92726001)(229853001)(47776003)(36756003)(99396003)(21056001)(84676001)(50986999)(88136002)(89996001)(68736004)(50466002)(86152002)(92566001)(101416001)(19580405001)(102836001)(104166001)(44976005)(19580395003)(48376002)(87936001)(31966008); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2PR02MB201; H:atltwp01.amd.com; FPR:; MLV:sfv; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; X-Microsoft-Antispam: UriScan:; X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:BY2PR02MB201; X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:;SRVR:BY2PR02MB201; X-Forefront-PRVS: 0402872DA1 X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:;SRVR:BY2PR02MB201; X-OriginatorOrg: amd4.onmicrosoft.com Sender: linux-pci-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Suravee Suthikulpanit This patch checks if the parent domain is NULL before recursively freeing irqs in the parent domains. In this case, GICv2m is freeing irqs in parent (GIC), which calls irq_domain_free_irqs_top. This fixes the crash below: Unble to handle kernel NULL pointer dereference at virtual address 00000018 pgd = fffffe03c78c0000 [00000018] *pgd=00000083c8700003, *pud=00000083c8700003, *pmd=00000083c8700003, *pte=0000000000000000 Internal error: Oops: 96000007 [#1] SMP Modules linked in: mlx4_core(-) rtc_efi efivarfs [last unloaded: mlx4_en] CPU: 5 PID: 985 Comm: modprobe Not tainted 3.18.0-rc4-marc-v2m+ #223 task: fffffe03c20c0000 ti: fffffe03c1fb8000 task.ti: fffffe03c1fb8000 PC is at irq_domain_free_irqs_recursive+0x10/0x84 LR is at irq_domain_free_irqs_common+0x8c/0xa0 pc : [] lr : [] pstate: 60000145 sp : fffffe03c1fbb9a0 x29: fffffe03c1fbb9a0 x28: fffffe03c1fb8000 x27: fffffe000092f000 x26: fffffe03c10eba00 ... Call trace: [] irq_domain_free_irqs_recursive+0x10/0x84 [] irq_domain_free_irqs_common+0x88/0xa0 [] irq_domain_free_irqs_top+0x6c/0x84 [] irq_domain_free_irqs_recursive+0x24/0x84 [] irq_domain_free_irqs_parent+0x14/0x20 [] gicv2m_irq_domain_free+0x48/0x88 [] irq_domain_free_irqs_recursive+0x24/0x84 [] irq_domain_free_irqs_common+0x88/0xa0 [] irq_domain_free_irqs_top+0x6c/0x84 [] msi_domain_free+0x74/0x8c [] irq_domain_free_irqs_recursive+0x24/0x84 [] irq_domain_free_irqs+0x110/0x184 [] msi_domain_free_irqs+0x28/0x4c [] free_msi_irqs+0x90/0x1d8 [] pci_disable_msix+0x40/0x50 Signed-off-by: Suravee Suthikulpanit --- kernel/irq/irqdomain.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c index 029acf1..4390eb8 100644 --- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -1166,6 +1166,9 @@ int irq_domain_alloc_irqs_parent(struct irq_domain *domain, void irq_domain_free_irqs_parent(struct irq_domain *domain, unsigned int irq_base, unsigned int nr_irqs) { + if (!domain->parent) + return; + /* irq_domain_free_irqs_recursive() will call parent's free */ if (!irq_domain_is_auto_recursive(domain)) irq_domain_free_irqs_recursive(domain->parent, irq_base,