From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, "Chen Hong" <chenhong3@huawei.com>,
"Dmitry Torokhov" <dmitry.torokhov@gmail.com>
Subject: [PATCH 3.2 43/74] Input: i8042 - fix crash at boot time
Date: Mon, 09 Oct 2017 13:30:34 +0100 [thread overview]
Message-ID: <lsq.1507552234.275251767@decadent.org.uk> (raw)
In-Reply-To: <lsq.1507552233.547064726@decadent.org.uk>
3.2.94-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Chen Hong <chenhong3@huawei.com>
commit 340d394a789518018f834ff70f7534fc463d3226 upstream.
The driver checks port->exists twice in i8042_interrupt(), first when
trying to assign temporary "serio" variable, and second time when deciding
whether it should call serio_interrupt(). The value of port->exists may
change between the 2 checks, and we may end up calling serio_interrupt()
with a NULL pointer:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000050
IP: [<ffffffff8150feaf>] _spin_lock_irqsave+0x1f/0x40
PGD 0
Oops: 0002 [#1] SMP
last sysfs file:
CPU 0
Modules linked in:
Pid: 1, comm: swapper Not tainted 2.6.32-358.el6.x86_64 #1 QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:[<ffffffff8150feaf>] [<ffffffff8150feaf>] _spin_lock_irqsave+0x1f/0x40
RSP: 0018:ffff880028203cc0 EFLAGS: 00010082
RAX: 0000000000010000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000282 RSI: 0000000000000098 RDI: 0000000000000050
RBP: ffff880028203cc0 R08: ffff88013e79c000 R09: ffff880028203ee0
R10: 0000000000000298 R11: 0000000000000282 R12: 0000000000000050
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000098
FS: 0000000000000000(0000) GS:ffff880028200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000050 CR3: 0000000001a85000 CR4: 00000000001407f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper (pid: 1, threadinfo ffff88013e79c000, task ffff88013e79b500)
Stack:
ffff880028203d00 ffffffff813de186 ffffffffffffff02 0000000000000000
<d> 0000000000000000 0000000000000000 0000000000000000 0000000000000098
<d> ffff880028203d70 ffffffff813e0162 ffff880028203d20 ffffffff8103b8ac
Call Trace:
<IRQ>
[<ffffffff813de186>] serio_interrupt+0x36/0xa0
[<ffffffff813e0162>] i8042_interrupt+0x132/0x3a0
[<ffffffff8103b8ac>] ? kvm_clock_read+0x1c/0x20
[<ffffffff8103b8b9>] ? kvm_clock_get_cycles+0x9/0x10
[<ffffffff810e1640>] handle_IRQ_event+0x60/0x170
[<ffffffff8103b154>] ? kvm_guest_apic_eoi_write+0x44/0x50
[<ffffffff810e3d8e>] handle_edge_irq+0xde/0x180
[<ffffffff8100de89>] handle_irq+0x49/0xa0
[<ffffffff81516c8c>] do_IRQ+0x6c/0xf0
[<ffffffff8100b9d3>] ret_from_intr+0x0/0x11
[<ffffffff81076f63>] ? __do_softirq+0x73/0x1e0
[<ffffffff8109b75b>] ? hrtimer_interrupt+0x14b/0x260
[<ffffffff8100c1cc>] ? call_softirq+0x1c/0x30
[<ffffffff8100de05>] ? do_softirq+0x65/0xa0
[<ffffffff81076d95>] ? irq_exit+0x85/0x90
[<ffffffff81516d80>] ? smp_apic_timer_interrupt+0x70/0x9b
[<ffffffff8100bb93>] ? apic_timer_interrupt+0x13/0x20
To avoid the issue let's change the second check to test whether serio is
NULL or not.
Also, let's take i8042_lock in i8042_start() and i8042_stop() instead of
trying to be overly smart and using memory barriers.
Signed-off-by: Chen Hong <chenhong3@huawei.com>
[dtor: take lock in i8042_start()/i8042_stop()]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/input/serio/i8042.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -390,8 +390,10 @@ static int i8042_start(struct serio *ser
{
struct i8042_port *port = serio->port_data;
+ spin_lock_irq(&i8042_lock);
port->exists = true;
- mb();
+ spin_unlock_irq(&i8042_lock);
+
return 0;
}
@@ -404,16 +406,20 @@ static void i8042_stop(struct serio *ser
{
struct i8042_port *port = serio->port_data;
+ spin_lock_irq(&i8042_lock);
port->exists = false;
+ port->serio = NULL;
+ spin_unlock_irq(&i8042_lock);
/*
+ * We need to make sure that interrupt handler finishes using
+ * our serio port before we return from this function.
* We synchronize with both AUX and KBD IRQs because there is
* a (very unlikely) chance that AUX IRQ is raised for KBD port
* and vice versa.
*/
synchronize_irq(I8042_AUX_IRQ);
synchronize_irq(I8042_KBD_IRQ);
- port->serio = NULL;
}
/*
@@ -530,7 +536,7 @@ static irqreturn_t i8042_interrupt(int i
spin_unlock_irqrestore(&i8042_lock, flags);
- if (likely(port->exists && !filtered))
+ if (likely(serio && !filtered))
serio_interrupt(serio, data, dfl);
out:
next prev parent reply other threads:[~2017-10-09 13:04 UTC|newest]
Thread overview: 77+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-09 12:30 [PATCH 3.2 00/74] 3.2.94-rc1 review Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 53/74] reiserfs: preserve i_mode if __reiserfs_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 46/74] mm: fix overflow check in expand_upwards() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 49/74] ext2: preserve i_mode if ext2_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 65/74] Bluetooth: Properly check L2CAP config option output buffer length Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 15/74] scsi: bnx2i: missing error code in bnx2i_ep_connect() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 60/74] nl80211: check for the required netlink attributes presence Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 34/74] s390/syscalls: Fix out of bounds arguments access Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 19/74] PCI: Mark Haswell Power Control Unit as having non-compliant BARs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 28/74] ipv6: always add flag an address that failed DAD with DADFAILED Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 24/74] btrfs: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 37/74] cfg80211: Check if PMKID attribute is of expected size Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 05/74] [media] mceusb: fix memory leaks in error path Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 35/74] rtc: rtc-nuc900: fix loop timeout test Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 48/74] ext2: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 58/74] [media] saa7164: fix sparse warnings Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 63/74] xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 47/74] vt: fix unchecked __put_user() in tioclinux ioctls Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 23/74] Add USB quirk for HVR-950q to avoid intermittent device resets Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 29/74] ipv6: dad: don't remove dynamic addresses if link is down Ben Hutchings
2017-10-09 12:30 ` Ben Hutchings [this message]
2017-10-09 12:30 ` [PATCH 3.2 54/74] ext4: preserve i_mode if __ext4_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 11/74] udf: Fix races with i_size changes during readpage Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 38/74] cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 39/74] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 40/74] fs/dcache.c: fix spin lockup issue on nlru->lock Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 12/74] udf: Fix deadlock between writeback and udf_setsize() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 51/74] ext3: preserve i_mode if ext2_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 56/74] btrfs: preserve i_mode if __btrfs_set_acl() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 55/74] ext4: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 67/74] netfilter: nf_conntrack: fix RCU race in nf_conntrack_find_get Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 10/74] md: don't use flush_signals in userspace processes Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 18/74] USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 68/74] MIPS: Refactor 'clear_page' and 'copy_page' functions Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 73/74] sched: add macros to define bitops for task atomic flags Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 45/74] ubifs: Don't leak kernel memory to the MTD Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 13/74] xhci: Limit USB2 port wake support for AMD Promontory hosts Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 41/74] powerpc/asm: Mark cr0 as clobbered in mftb() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 03/74] mwifiex: fixup error cases in mwifiex_add_virtual_intf() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 57/74] [media] saa7164: fix endian conversion in saa7164_bus_set() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 72/74] net sched filters: fix notification of filter delete with proper handle Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 02/74] sched/topology: Fix building of overlapping sched-groups Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 06/74] perf/core: Correct event creation with PERF_FORMAT_GROUP Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 61/74] kvm: nVMX: Don't allow L2 to access the hardware CR8 Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 30/74] drm/i915: Disable MSI for all pre-gen5 Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 04/74] wlcore: fix 64K page support Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 14/74] af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 01/74] sched/fair, cpumask: Export for_each_cpu_wrap() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 26/74] scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 07/74] usb: usbip: set buffer pointers to NULL after free Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 17/74] MIPS: Fix mips_atomic_set() retry condition Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 44/74] ubifs: Correctly evict xattr inodes Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 71/74] m32r: add io*_rep helpers Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 31/74] IB/core: Create common start/end port functions Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 36/74] tpm: fix a kernel memory leak in tpm-sysfs.c Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 52/74] reiserfs: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 42/74] powerpc: Fix emulation of mfocrf in emulate_step() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 50/74] ext3: Don't clear SGID when inheriting ACLs Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 08/74] usb: Fix typo in the definition of Endpoint[out]Request Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 16/74] scsi: sun_esp: fix device reference leaks Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 62/74] video: fbdev: aty: do not leak uninitialized padding in clk to userspace Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 32/74] IB/core: Add inline function to validate port Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 69/74] perf/x86: Check if user fp is valid Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 21/74] PM / Domains: Fix unsafe iteration over modified list of device links Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 27/74] parisc: use compat_sys_keyctl() Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 33/74] RDMA/uverbs: Check port number supplied by user verbs cmds Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 70/74] m32r: add definition of ioremap_wc to io.h Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 66/74] l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 09/74] PCI: Correct PCI_STD_RESOURCE_END usage Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 74/74] cpuset: PF_SPREAD_PAGE and PF_SPREAD_SLAB should be atomic flags Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 64/74] scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 20/74] PCI: Work around poweroff & suspend-to-RAM issue on Macbook Pro 11 Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 25/74] PCI/PM: Restore the status of PCI devices across hibernation Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 59/74] [media] saa7164: fix double fetch PCIe access condition Ben Hutchings
2017-10-09 12:30 ` [PATCH 3.2 22/74] MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn' Ben Hutchings
2017-10-09 15:53 ` [PATCH 3.2 00/74] 3.2.94-rc1 review Guenter Roeck
2017-10-09 17:21 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1507552234.275251767@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=chenhong3@huawei.com \
--cc=dmitry.torokhov@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®