From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S933785AbcBZQtz (ORCPT <rfc822;w@1wt.eu>);
	Fri, 26 Feb 2016 11:49:55 -0500
Received: from mail333.us4.mandrillapp.com ([205.201.137.77]:58617 "EHLO
	mail333.us4.mandrillapp.com" rhost-flags-OK-OK-OK-OK)
	by vger.kernel.org with ESMTP id S933768AbcBZQtw (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Fri, 26 Feb 2016 11:49:52 -0500
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mandrill; d=linuxfoundation.org;
 b=UEluiO0XZGR4+DExvClSNz2ZhwV/4a2eiejSpau0oDkoemFJo/M6FACUUFqeK1QwLk04mimRAwdW
   1ewLRRNMC1mKMwZHrJkLGA4fMdv1iUOgQlYf4o7z3dAGyzjK3A7bwdxwU3VjdZ3E/3OlZTp9Yg/m
   ZBkPH2Yx0+J8HIbhqSg=;
From: Greg KH <gregkh@linuxfoundation.org>
Subject: Re: BUG: unable to handle kernel paging request from pty_write [was: Linux 4.4.2]
To: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
        Peter Hurley <peter@hurleysoftware.com>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        stable <stable@vger.kernel.org>, <lwn@lwn.net>,
        Steven Rostedt <rostedt@goodmis.org>
Message-Id: <20160226163439.GA12517@kroah.com>
References: <56CED373.9060603@suse.cz> <56CF4A83.3040408@hurleysoftware.com> <CA+55aFyeVmnNuk5pPoH05uPKZRSXt1hv_0PWuvndptqBSfPrbA@mail.gmail.com> <56CF64C9.8050705@hurleysoftware.com> <CA+55aFx306jsTaUkm_c4nJtEo=A3vdDFYqqpLJj1zKUh=wLxog@mail.gmail.com> <56CF72EA.9040009@suse.cz> <CA+55aFzQzCKhX73bUYwNMK8Dd9ECtmav8u7ds2aXKjEo7DV3Gg@mail.gmail.com> <56D01331.5030401@suse.cz> <56D01984.5010607@suse.cz> <56D01FE3.3000308@suse.cz>
In-Reply-To: <56D01FE3.3000308@suse.cz>
X-Report-Abuse: Please forward a copy of this message, including all headers, to abuse@mandrill.com
X-Report-Abuse: You can also report abuse here: http://mandrillapp.com/contact/abuse?id=30481620.a1869a774dc34a0db69073317c91b486
X-Mandrill-User: md_30481620
Date: Fri, 26 Feb 2016 16:34:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Feb 26, 2016 at 10:50:27AM +0100, Jiri Slaby wrote:
> On 02/26/2016, 10:23 AM, Jiri Slaby wrote:
> > On 02/26/2016, 09:56 AM, Jiri Slaby wrote:
> >>> I really don't see how it would happen here - that code doesn't look
> >>> particularly odd.
> > 
> > Funnily enough, this is what I got today, when booting 4.4.2 in qemu VM
> > on my host.
> > 
> > RIP crashing (ffffffff810f28d5) is action->dev_id dereference in
> > handle_irq_event_percpu. Look:
> >    0xffffffff810f28d5 <+101>:   mov    0x8(%rbx),%rsi
> >    0xffffffff810f28d9 <+105>:   mov    %r12d,%edi
> >    0xffffffff810f28dc <+108>:   callq  *(%rbx)
> > which is
> >        trace_irq_handler_entry(irq, action);
> >        res = action->handler(irq, action->dev_id);
> >        trace_irq_handler_exit(irq, action, res);
> > 
> ...
> > So is this the same bug or not?
> 
> Seems not, actually. I think I need:
> commit 570540d50710ed192e98e2f7f74578c9486b6b05
> Author: Thomas Gleixner <tglx@linutronix.de>
> Date:   Wed Jan 13 14:07:25 2016 +0100
> 
>     genirq: Validate action before dereferencing it in
> handle_irq_event_percpu()

That's in my queue to pick up later today, sorry about that.

greg k-h