forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers/input/serio
History
Chen Hong bba6b69e11 Input: i8042 - fix crash at boot time 
commit 340d394a78 upstream.

The driver checks port->exists twice in i8042_interrupt(), first when
trying to assign temporary "serio" variable, and second time when deciding
whether it should call serio_interrupt(). The value of port->exists may
change between the 2 checks, and we may end up calling serio_interrupt()
with a NULL pointer:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000050
IP: [<ffffffff8150feaf>] _spin_lock_irqsave+0x1f/0x40
PGD 0
Oops: 0002 [#1] SMP
last sysfs file:
CPU 0
Modules linked in:

Pid: 1, comm: swapper Not tainted 2.6.32-358.el6.x86_64 #1 QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:[<ffffffff8150feaf>]  [<ffffffff8150feaf>] _spin_lock_irqsave+0x1f/0x40
RSP: 0018:ffff880028203cc0  EFLAGS: 00010082
RAX: 0000000000010000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000282 RSI: 0000000000000098 RDI: 0000000000000050
RBP: ffff880028203cc0 R08: ffff88013e79c000 R09: ffff880028203ee0
R10: 0000000000000298 R11: 0000000000000282 R12: 0000000000000050
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000098
FS:  0000000000000000(0000) GS:ffff880028200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000050 CR3: 0000000001a85000 CR4: 00000000001407f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper (pid: 1, threadinfo ffff88013e79c000, task ffff88013e79b500)
Stack:
ffff880028203d00 ffffffff813de186 ffffffffffffff02 0000000000000000
<d> 0000000000000000 0000000000000000 0000000000000000 0000000000000098
<d> ffff880028203d70 ffffffff813e0162 ffff880028203d20 ffffffff8103b8ac
Call Trace:
<IRQ>
 [<ffffffff813de186>] serio_interrupt+0x36/0xa0
[<ffffffff813e0162>] i8042_interrupt+0x132/0x3a0
[<ffffffff8103b8ac>] ? kvm_clock_read+0x1c/0x20
[<ffffffff8103b8b9>] ? kvm_clock_get_cycles+0x9/0x10
[<ffffffff810e1640>] handle_IRQ_event+0x60/0x170
[<ffffffff8103b154>] ? kvm_guest_apic_eoi_write+0x44/0x50
[<ffffffff810e3d8e>] handle_edge_irq+0xde/0x180
[<ffffffff8100de89>] handle_irq+0x49/0xa0
[<ffffffff81516c8c>] do_IRQ+0x6c/0xf0
[<ffffffff8100b9d3>] ret_from_intr+0x0/0x11
[<ffffffff81076f63>] ? __do_softirq+0x73/0x1e0
[<ffffffff8109b75b>] ? hrtimer_interrupt+0x14b/0x260
[<ffffffff8100c1cc>] ? call_softirq+0x1c/0x30
[<ffffffff8100de05>] ? do_softirq+0x65/0xa0
[<ffffffff81076d95>] ? irq_exit+0x85/0x90
[<ffffffff81516d80>] ? smp_apic_timer_interrupt+0x70/0x9b
[<ffffffff8100bb93>] ? apic_timer_interrupt+0x13/0x20

To avoid the issue let's change the second check to test whether serio is
NULL or not.

Also, let's take i8042_lock in i8042_start() and i8042_stop() instead of
trying to be overly smart and using memory barriers.

Signed-off-by: Chen Hong <chenhong3@huawei.com>
[dtor: take lock in i8042_start()/i8042_stop()]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-27 15:06:08 -07:00
..
altera_ps2.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2014-12-17 10:06:02 -08:00
ambakmi.c Input: ambakmi - fix system PM by converting to modern callbacks 2015-07-16 10:36:08 -07:00
ams_delta_serio.c ARM: OMAP1: Move board-ams-delta.h from plat to mach 2012-09-20 15:02:19 -07:00
apbps2.c input: serio: drop owner assignment from platform_drivers 2014-10-20 16:20:41 +02:00
arc_ps2.c input: serio: drop owner assignment from platform_drivers 2014-10-20 16:20:41 +02:00
at32psif.c input: serio: drop owner assignment from platform_drivers 2014-10-20 16:20:41 +02:00
ct82c710.c input: serio: drop owner assignment from platform_drivers 2014-10-20 16:20:41 +02:00
gscps2.c Input: gscps2 - drop pci_ids dependency 2015-04-06 09:38:08 -07:00
hil_mlc.c Input: HIL - do not call tasklet_disable right before tasklet_kill 2012-11-25 00:10:13 -08:00
hp_sdc.c Input: hp_sdc - use del_timer_sync() in exit path 2014-03-23 17:25:40 -07:00
hp_sdc_mlc.c
hyperv-keyboard.c Input: hyperv-keyboard - register as a wakeup source 2014-08-06 14:10:06 -07:00
i8042-io.h Input: i8042 - skip selftest on ASUS laptops 2016-10-28 03:01:31 -04:00
i8042-ip22io.h Input: i8042 - skip selftest on ASUS laptops 2016-10-28 03:01:31 -04:00
i8042-jazzio.h
i8042-ppcio.h Input: i8042 - skip selftest on ASUS laptops 2016-10-28 03:01:31 -04:00
i8042-snirm.h
i8042-sparcio.h Input: i8042 - skip selftest on ASUS laptops 2016-10-28 03:01:31 -04:00
i8042-unicore32io.h Input: i8042 - skip selftest on ASUS laptops 2016-10-28 03:01:31 -04:00
i8042-x86ia64io.h Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list 2017-06-29 12:48:51 +02:00
i8042.c Input: i8042 - fix crash at boot time 2017-07-27 15:06:08 -07:00
i8042.h Input: i8042 - add unmask_kbd_data option 2015-07-16 10:30:55 -07:00
Kconfig Input: add userio module 2015-10-27 18:55:31 -07:00
libps2.c Input: i8042 - break load dependency between atkbd/psmouse and i8042 2016-09-07 08:32:44 +02:00
maceps2.c input: serio: drop owner assignment from platform_drivers 2014-10-20 16:20:41 +02:00
Makefile Input: add userio module 2015-10-27 18:55:31 -07:00
olpc_apsp.c input: serio: drop owner assignment from platform_drivers 2014-10-20 16:20:41 +02:00
parkbd.c Input: parkbd - clear unused function pointers 2015-11-17 10:00:16 -08:00
pcips2.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
ps2mult.c Input: serio - use module_serio_driver 2012-04-04 09:25:43 -07:00
q40kbd.c input: serio: drop owner assignment from platform_drivers 2014-10-20 16:20:41 +02:00
rpckbd.c input: serio: drop owner assignment from platform_drivers 2014-10-20 16:20:41 +02:00
sa1111ps2.c Input: remove use of __devexit 2012-11-24 00:05:38 -08:00
serio.c Input: i8042 - add unmask_kbd_data option 2015-07-16 10:30:55 -07:00
serio_raw.c Input: initialize device counter variables with -1 2014-12-03 15:27:17 -08:00
serport.c tty: remove buf parameter from tty_name() 2015-05-06 22:26:57 +02:00
sun4i-ps2.c Input: serio - add support for Alwinner A10/A20 PS/2 controller 2015-01-26 23:10:13 -08:00
userio.c Input: add userio module 2015-10-27 18:55:31 -07:00
xilinx_ps2.c input: serio: drop owner assignment from platform_drivers 2014-10-20 16:20:41 +02:00