991b3458da
commit eddf3e9c7c7e4d0707c68d1bb22cc6ec8aef7d4a upstream.
The following crash was observed:
Unable to handle kernel NULL pointer dereference at 0000000000000158
Internal error: Oops: 96000004 [#1] SMP
pc : resend_irqs+0x68/0xb0
lr : resend_irqs+0x64/0xb0
...
Call trace:
resend_irqs+0x68/0xb0
tasklet_action_common.isra.6+0x84/0x138
tasklet_action+0x2c/0x38
__do_softirq+0x120/0x324
run_ksoftirqd+0x44/0x60
smpboot_thread_fn+0x1ac/0x1e8
kthread+0x134/0x138
ret_from_fork+0x10/0x18
The reason for this is that the interrupt resend mechanism happens in soft
interrupt context, which is a asynchronous mechanism versus other
operations on interrupts. free_irq() does not take resend handling into
account. Thus, the irq descriptor might be already freed before the resend
tasklet is executed. resend_irqs() does not check the return value of the
interrupt descriptor lookup and derefences the return value
unconditionally.
1):
__setup_irq
irq_startup
check_irq_resend // activate softirq to handle resend irq
2):
irq_domain_free_irqs
irq_free_descs
free_desc
call_rcu(&desc->rcu, delayed_free_desc)
3):
__do_softirq
tasklet_action
resend_irqs
desc = irq_to_desc(irq)
desc->handle_irq(desc) // desc is NULL --> Ooops
Fix this by adding a NULL pointer check in resend_irqs() before derefencing
the irq descriptor.
Fixes: a4633adcdb ("[PATCH] genirq: add genirq sw IRQ-retrigger")
Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1630ae13-5c8e-901e-de09-e740b6a426a7@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
102 lines
2.5 KiB
C
102 lines
2.5 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright (C) 1992, 1998-2006 Linus Torvalds, Ingo Molnar
|
|
* Copyright (C) 2005-2006, Thomas Gleixner
|
|
*
|
|
* This file contains the IRQ-resend code
|
|
*
|
|
* If the interrupt is waiting to be processed, we try to re-run it.
|
|
* We can't directly run it from here since the caller might be in an
|
|
* interrupt-protected region. Not all irq controller chips can
|
|
* retrigger interrupts at the hardware level, so in those cases
|
|
* we allow the resending of IRQs via a tasklet.
|
|
*/
|
|
|
|
#include <linux/irq.h>
|
|
#include <linux/module.h>
|
|
#include <linux/random.h>
|
|
#include <linux/interrupt.h>
|
|
|
|
#include "internals.h"
|
|
|
|
#ifdef CONFIG_HARDIRQS_SW_RESEND
|
|
|
|
/* Bitmap to handle software resend of interrupts: */
|
|
static DECLARE_BITMAP(irqs_resend, IRQ_BITMAP_BITS);
|
|
|
|
/*
|
|
* Run software resends of IRQ's
|
|
*/
|
|
static void resend_irqs(unsigned long arg)
|
|
{
|
|
struct irq_desc *desc;
|
|
int irq;
|
|
|
|
while (!bitmap_empty(irqs_resend, nr_irqs)) {
|
|
irq = find_first_bit(irqs_resend, nr_irqs);
|
|
clear_bit(irq, irqs_resend);
|
|
desc = irq_to_desc(irq);
|
|
if (!desc)
|
|
continue;
|
|
local_irq_disable();
|
|
desc->handle_irq(desc);
|
|
local_irq_enable();
|
|
}
|
|
}
|
|
|
|
/* Tasklet to handle resend: */
|
|
static DECLARE_TASKLET(resend_tasklet, resend_irqs, 0);
|
|
|
|
#endif
|
|
|
|
/*
|
|
* IRQ resend
|
|
*
|
|
* Is called with interrupts disabled and desc->lock held.
|
|
*/
|
|
void check_irq_resend(struct irq_desc *desc)
|
|
{
|
|
/*
|
|
* We do not resend level type interrupts. Level type
|
|
* interrupts are resent by hardware when they are still
|
|
* active. Clear the pending bit so suspend/resume does not
|
|
* get confused.
|
|
*/
|
|
if (irq_settings_is_level(desc)) {
|
|
desc->istate &= ~IRQS_PENDING;
|
|
return;
|
|
}
|
|
if (desc->istate & IRQS_REPLAY)
|
|
return;
|
|
if (desc->istate & IRQS_PENDING) {
|
|
desc->istate &= ~IRQS_PENDING;
|
|
desc->istate |= IRQS_REPLAY;
|
|
|
|
if (!desc->irq_data.chip->irq_retrigger ||
|
|
!desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
|
|
#ifdef CONFIG_HARDIRQS_SW_RESEND
|
|
unsigned int irq = irq_desc_get_irq(desc);
|
|
|
|
/*
|
|
* If the interrupt is running in the thread
|
|
* context of the parent irq we need to be
|
|
* careful, because we cannot trigger it
|
|
* directly.
|
|
*/
|
|
if (irq_settings_is_nested_thread(desc)) {
|
|
/*
|
|
* If the parent_irq is valid, we
|
|
* retrigger the parent, otherwise we
|
|
* do nothing.
|
|
*/
|
|
if (!desc->parent_irq)
|
|
return;
|
|
irq = desc->parent_irq;
|
|
}
|
|
/* Set it pending and activate the softirq: */
|
|
set_bit(irq, irqs_resend);
|
|
tasklet_schedule(&resend_tasklet);
|
|
#endif
|
|
}
|
|
}
|
|
}
|