From: Greg KH <gregkh@linuxfoundation.org>
To: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Peter Hurley <peter@hurleysoftware.com>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
stable <stable@vger.kernel.org>, <lwn@lwn.net>,
Steven Rostedt <rostedt@goodmis.org>
Subject: Re: BUG: unable to handle kernel paging request from pty_write [was: Linux 4.4.2]
Date: Fri, 26 Feb 2016 16:34:44 +0000 [thread overview]
Message-ID: <20160226163439.GA12517@kroah.com> (raw)
In-Reply-To: <56D01FE3.3000308@suse.cz>
On Fri, Feb 26, 2016 at 10:50:27AM +0100, Jiri Slaby wrote:
> On 02/26/2016, 10:23 AM, Jiri Slaby wrote:
> > On 02/26/2016, 09:56 AM, Jiri Slaby wrote:
> >>> I really don't see how it would happen here - that code doesn't look
> >>> particularly odd.
> >
> > Funnily enough, this is what I got today, when booting 4.4.2 in qemu VM
> > on my host.
> >
> > RIP crashing (ffffffff810f28d5) is action->dev_id dereference in
> > handle_irq_event_percpu. Look:
> > 0xffffffff810f28d5 <+101>: mov 0x8(%rbx),%rsi
> > 0xffffffff810f28d9 <+105>: mov %r12d,%edi
> > 0xffffffff810f28dc <+108>: callq *(%rbx)
> > which is
> > trace_irq_handler_entry(irq, action);
> > res = action->handler(irq, action->dev_id);
> > trace_irq_handler_exit(irq, action, res);
> >
> ...
> > So is this the same bug or not?
>
> Seems not, actually. I think I need:
> commit 570540d50710ed192e98e2f7f74578c9486b6b05
> Author: Thomas Gleixner <tglx@linutronix.de>
> Date: Wed Jan 13 14:07:25 2016 +0100
>
> genirq: Validate action before dereferencing it in
> handle_irq_event_percpu()
That's in my queue to pick up later today, sorry about that.
greg k-h
next prev parent reply other threads:[~2016-02-26 16:49 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-17 20:37 Linux 4.4.2 Greg KH
2016-02-17 20:37 ` Greg KH
2016-02-25 10:12 ` BUG: unable to handle kernel paging request from pty_write [was: Linux 4.4.2] Jiri Slaby
2016-02-25 18:40 ` Peter Hurley
2016-02-25 19:09 ` Linus Torvalds
2016-02-25 19:23 ` Steven Rostedt
2016-02-26 8:25 ` Jiri Slaby
2016-02-25 20:32 ` Peter Hurley
2016-02-25 20:51 ` Linus Torvalds
2016-02-25 21:32 ` Jiri Slaby
2016-02-25 22:33 ` Peter Hurley
2016-02-26 0:38 ` Peter Hurley
2016-02-26 8:45 ` Jiri Slaby
2016-02-26 0:38 ` Linus Torvalds
2016-02-26 8:56 ` Jiri Slaby
2016-02-26 9:23 ` Jiri Slaby
2016-02-26 9:50 ` Jiri Slaby
2016-02-26 16:34 ` Greg KH [this message]
2016-02-26 17:12 ` Linus Torvalds
2016-02-29 15:45 ` Paolo Bonzini
2016-02-26 17:52 ` Peter Hurley
2016-02-25 21:43 ` Peter Hurley
2016-02-25 22:00 ` Jiri Kosina
2016-02-26 8:31 ` Jiri Slaby
2016-02-26 8:15 ` Jiri Slaby
2016-02-26 18:05 Linus Torvalds
2016-02-26 18:17 ` Borislav Petkov
2016-02-26 18:18 ` Peter Hurley
2016-02-26 19:44 ` Linus Torvalds
2016-02-26 19:59 ` Robert Święcki
2016-02-29 7:39 ` Jiri Slaby
2016-02-29 12:43 ` Henrique de Moraes Holschuh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160226163439.GA12517@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=jslaby@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=lwn@lwn.net \
--cc=peter@hurleysoftware.com \
--cc=rostedt@goodmis.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.