From: Jiri Slaby <jslaby@suse.cz>
To: Borislav Petkov <bp@alien8.de>, linux-serial@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-kernel@vger.kernel.org,
Michael Galbraith <mgalbraith@suse.de>
Subject: Re: BUG: unable to handle kernel NULL pointer dereference at 00000000000001e0
Date: Mon, 24 Oct 2016 17:28:24 +0200 [thread overview]
Message-ID: <49489eb2-c7f5-369b-4552-d888cbc27719@suse.cz> (raw)
In-Reply-To: <20161024144831.a4ieul22jck4vwk3@pd.tnic>
On 10/24/2016, 04:48 PM, Borislav Petkov wrote:
> Hi people,
>
> typing "reboot" splats the following on the serial console. Ideas?
>
> INIT: Sending p[ 427.863916] BUG: unable to handle kernel NULL pointer dereference at 00000000000001e0
> [ 427.885156] IP: [<ffffffffa24bfb6c>] tty_wakeup+0xc/0x70
> [ 427.898337] PGD 0 [ 427.902051]
> [ 427.907498] Oops: 0000 [#1] PREEMPT SMP
> [ 427.917635] Modules linked in: nfsv3 nfs_acl nfs fscache lockd sunrpc grace edd af_packet cpufreq_conservative cpufreq_userspace cpufreq_powersave fuse loop md_mod dm_mod joydev hid_generic usbhid ipmi_ssif ohci_pci ohci_hcd ehci_pci ehci_hcd e1000e ptp firewire_ohci edac_core pps_core tpm_infineon sp5100_tco firewire_core acpi_cpufreq serio_raw pcspkr fjes usbcore shpchp edac_mce_amd tpm_tis ipmi_si tpm_tis_core i2c_piix4 k10temp sg ipmi_msghandler tpm sr_mod button cdrom kvm_amd kvm irqbypass crc_itu_t ast ttm drm_kms_helper drm fb_sys_fops sysimgblt sysfillrect syscopyarea i2c_algo_bit scsi_dh_rdac scsi_dh_alua scsi_dh_emc scsi_dh_hp_sw ata_generic pata_atiixp
> [ 428.054179] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.9.0-rc1-1.g73e3f23-default #1
> [ 428.072868] Hardware name: System manufacturer System Product Name/KGP(M)E-D16, BIOS 0902 12/03/2010
> [ 428.094755] task: ffffffffa2c0d500 task.stack: ffffffffa2c00000
> [ 428.109717] RIP: 0010:[<ffffffffa24bfb6c>] [<ffffffffa24bfb6c>] tty_wakeup+0xc/0x70
> [ 428.128407] RSP: 0018:ffff9a1a5fc03df8 EFLAGS: 00010086
> [ 428.142184] RAX: ffff9a1857258000 RBX: ffffffffa3050ea0 RCX: 0000000000000000
> [ 428.159649] RDX: 000000000000001b RSI: 0000000000000000 RDI: 0000000000000000
> [ 428.177109] RBP: ffff9a1a5fc03e08 R08: 0000000000000000 R09: 0000000000000000
> [ 428.194547] R10: 0000000000021c77 R11: 0000000000000000 R12: ffff9a1857258000
> [ 428.212002] R13: 0000000000000000 R14: 0000000000000020 R15: 0000000000000020
> [ 428.229481] FS: 0000000000000000(0000) GS:ffff9a1a5fc00000(0000) knlGS:0000000000000000
> [ 428.248938] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 428.263726] CR2: 00000000000001e0 CR3: 0000000390c06000 CR4: 00000000000006f0
> [ 428.281331] Stack:
> [ 428.288696] ffffffffa3050ea0 ffff9a1857258000 ffff9a1a5fc03e18 ffffffffa24e0ab1
> [ 428.307064] ffff9a1a5fc03e40 ffffffffa24e8865 ffffffffa3050ea0 00000000000000c2
> [ 428.325456] 0000000000000046 ffff9a1a5fc03e78 ffffffffa24e8a5f ffffffffa3050ea0
> [ 428.343905] Call Trace:
> [ 428.352319] <IRQ> [ 428.356216] [<ffffffffa24e0ab1>] uart_write_wakeup+0x21/0x30
>From the quick look, uart_write_wakeup should now be using refcounting.
Does this help (compile-tested only)?
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -106,12 +106,17 @@ static inline struct uart_port
*uart_port_check(struct uart_state *state)
void uart_write_wakeup(struct uart_port *port)
{
struct uart_state *state = port->state;
+ struct tty_struct *ttyp;
/*
* This means you called this function _after_ the port was
* closed. No cookie for you.
*/
BUG_ON(!state);
- tty_wakeup(state->port.tty);
+
+ ttyp = tty_port_tty_get(&state->port);
+ if (ttyp)
+ tty_wakeup(ttyp);
+ tty_kref_put(ttyp);
}
static void uart_stop(struct tty_struct *tty)
thanks,
--
js
suse labs
next prev parent reply other threads:[~2016-10-24 15:28 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-10-24 14:48 BUG: unable to handle kernel NULL pointer dereference at 00000000000001e0 Borislav Petkov
2016-10-24 15:19 ` Mike Galbraith
2016-10-24 15:28 ` Jiri Slaby [this message]
2016-10-24 18:56 ` Borislav Petkov
2016-10-25 1:47 ` Mike Galbraith
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=49489eb2-c7f5-369b-4552-d888cbc27719@suse.cz \
--to=jslaby@suse.cz \
--cc=bp@alien8.de \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-serial@vger.kernel.org \
--cc=mgalbraith@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).