linux-kernel - Re: [PATCH] genirq: check irq_ack callback in handle_edge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.11.1504211631130.13914@nanos>
Date:	Tue, 21 Apr 2015 16:40:16 +0200 (CEST)
From:	Thomas Gleixner <tglx@...utronix.de>
To:	Semen Protsenko <semen.protsenko@...ballogic.com>
cc:	linux-kernel@...r.kernel.org,
	Grygorii Strashko <grygorii.strashko@...ballogic.com>,
	Linus Walleij <linus.walleij@...aro.org>
Subject: Re: [PATCH] genirq: check irq_ack callback in handle_edge_irq()
 before calling

On Tue, 21 Apr 2015, Semen Protsenko wrote:
> Direct calling of .irq_ack callback (from struct irq_chip) leads to NULL
> pointer dereference in some cases. E.g. this was observed for MAX732X
> driver on hibernation:
> 
>     Unable to handle kernel NULL pointer dereference at virtual address 0
>     Backtrace:
>     (handle_edge_irq) from (resend_irqs)
>     (resend_irqs) from (tasklet_action)
>     (tasklet_action) from (__do_softirq)
>     (__do_softirq) from (run_ksoftirqd)
>     (run_ksoftirqd) from (smpboot_thread_fn)
>     (smpboot_thread_fn) from (kthread)
>     (kthread) from (ret_from_fork)
> 
> This patch checks if .irq_ack was set, so in case it wasn't (i.e. it's
> NULL) we wouldn't have NULL pointer dereference. This check seems to
> be pretty common in kernel/irq/chip.c, but it was missed for
> handle_edge_irq() function.

No, it's not missing by chance. It's missing on purpose. The edge
handler is designed to deal with edge type interrupt chips and those
have an ACK by definition.

You are fixing the wrong place. That GPIO expander is using the wrong
flow handler. It should not use the edge handler at all.

Thanks,

	tglx
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/