From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752833AbdLMLxE (ORCPT ); Wed, 13 Dec 2017 06:53:04 -0500 Received: from mx2.suse.de ([195.135.220.15]:46287 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752570AbdLMLxC (ORCPT ); Wed, 13 Dec 2017 06:53:02 -0500 Date: Wed, 13 Dec 2017 12:52:59 +0100 Message-ID: From: Takashi Iwai To: Thomas Gleixner Cc: "Anand, Jerome" , Ville =?UTF-8?B?U3lyasOkbMOk?= , "Chen, Augustine" , "intel-gfx@lists.freedesktop.org" , "alsa-devel@alsa-project.org" , "Bossart, Pierre-louis" , Ingo Molnar , "H. Peter Anvin" , Jiang Liu , Juergen Gross , Dou Liyang , "linux-kernel@vger.kernel.org" Subject: Re: [Intel-gfx] [PATCH] drm/i915: Remove unused IRQ chip data of HDMI LPE audio In-Reply-To: References: <20171208093323.2212-1-augustine.chen@intel.com> <20171208114404.GN10981@intel.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 13 Dec 2017 12:35:54 +0100, Thomas Gleixner wrote: > > > > On Mon, 11 Dec 2017, Anand, Jerome wrote: > > > > > On Fri, 8 Dec 2017, Ville Syrjälä wrote: > > > > > > > > > > > On Fri, Dec 08, 2017 at 05:33:23PM +0800, Augustine.Chen wrote: > > > > > > > The chip data of HDMI LPE audio is set to drm_i915_private which > > > > > > > is not consistent with the expectation by x86 APIC driver. > > > > > > > > > > > > Hmm. Why is the apic code looking at data for an irq chip it > > > > > > hasn't created? > > > > > > > > > > > > > > apic code expects an irq domain to be place as generic approach. > > > > > > APIC code does not even see that interrupt at all. It's completely disconnected. > > > > > > > That's the problem - APIC just converts the chip data to its internal > > format and fails. > > How does APIC code end up to touch that interrupt at all? Call stack please. It's found in the bugzilla referred in the patch: https://bugs.freedesktop.org/show_bug.cgi?id=103731 [ 87.353072] irq 298 idata->chip->name hdmi_lpe_audio_irqchip [ 87.353072] irq 298 apic_chip_data [ 87.353073] irq 298 data->domain is NULL [ 87.353120] BUG: unable to handle kernel NULL pointer dereference at (null) [ 87.353132] IP: setup_vector_irq+0x1ba/0x230 [ 87.353133] PGD 0 If my understanding is correct, it happens only with 4.14 and earlier kernels where __setup_vector_irq() loops over the all irqs: static void __setup_vector_irq(int cpu) { struct apic_chip_data *data; struct irq_desc *desc; int irq, vector; /* Mark the inuse vectors */ for_each_irq_desc(irq, desc) { struct irq_data *idata = irq_desc_get_irq_data(desc); data = apic_chip_data(idata); if (!data || !cpumask_test_cpu(cpu, data->domain)) continue; .... And since we have assigned a non-APIC chip data in the driver, the code above refers to a wrong object, leading to Oops. As a further note, the setup_vector_irq() code has been changed in 4.15, and such a reference won't happen any longer. So the patch isn't necessary for now, although it's not bad to take as a cleanup. And we can eventually put Cc to stable there since it actually works around the issue above for the older kernels -- of course, with more detailed descriptions about the background. thanks, Takashi