Patch "x86/irq: Validate that irq descriptor is still active" has been added to the 4.4-stable tree

[<gregkh@linuxfoundation.org>]

This is a note to let you know that I've just added the patch titled

    x86/irq: Validate that irq descriptor is still active

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     x86-irq-validate-that-irq-descriptor-is-still-active.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 36f34c8c63da3e272fd66f91089228c22d2b6e8b Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 31 Dec 2015 16:30:45 +0000
Subject: x86/irq: Validate that irq descriptor is still active

From: Thomas Gleixner <tglx@linutronix.de>

commit 36f34c8c63da3e272fd66f91089228c22d2b6e8b upstream.

In fixup_irqs() we unconditionally dereference the irq chip of an irq
descriptor. The descriptor might still be valid, but already cleaned up,
i.e. the chip removed. Add a check for this condition.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Jiang Liu <jiang.liu@linux.intel.com>
Cc: Joe Lawrence <joe.lawrence@stratus.com>
Cc: Jeremiah Mahler <jmmahler@gmail.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck <linux@roeck-us.net>
Link: http://lkml.kernel.org/r/20151231160106.236423282@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index f8062aaf5df9..c0b58dd1ca04 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -470,6 +470,15 @@ void fixup_irqs(void)
 		}
 
 		chip = irq_data_get_irq_chip(data);
+		/*
+		 * The interrupt descriptor might have been cleaned up
+		 * already, but it is not yet removed from the radix tree
+		 */
+		if (!chip) {
+			raw_spin_unlock(&desc->lock);
+			continue;
+		}
+
 		if (!irqd_can_move_in_process_context(data) && chip->irq_mask)
 			chip->irq_mask(data);
 


Patches currently in stable-queue which might be from tglx@linutronix.de are

queue-4.4/x86-irq-validate-that-irq-descriptor-is-still-active.patch
queue-4.4/x86-irq-remove-outgoing-cpu-from-vector-cleanup-mask.patch
queue-4.4/x86-irq-get-rid-of-code-duplication.patch
queue-4.4/x86-entry-compat-add-missing-clac-to-entry_int80_32.patch
queue-4.4/tick-nohz-set-the-correct-expiry-when-switching-to-nohz-lowres-mode.patch
queue-4.4/irqchip-mxs-add-missing-set_handle_irq.patch
queue-4.4/genirq-validate-action-before-dereferencing-it-in-handle_irq_event_percpu.patch
queue-4.4/x86-irq-remove-offline-cpus-from-vector-cleanup.patch
queue-4.4/posix-clock-fix-return-code-on-the-poll-method-s-error-path.patch
queue-4.4/x86-irq-reorganize-the-return-path-in-assign_irq_vector.patch
queue-4.4/cputime-prevent-32bit-overflow-in-time_to_cputime.patch
queue-4.4/x86-irq-copy-vectormask-instead-of-an-and-operation.patch
queue-4.4/x86-irq-call-irq_force_move_complete-with-irq-descriptor.patch
queue-4.4/x86-irq-call-chip-irq_set_affinity-in-proper-context.patch
queue-4.4/x86-irq-plug-vector-cleanup-race.patch
queue-4.4/x86-irq-do-not-use-apic_chip_data.old_domain-as-temporary-buffer.patch
queue-4.4/clockevents-tcb_clksrc-prevent-disabling-an-already-disabled-clock.patch
queue-4.4/x86-irq-reorganize-the-search-in-assign_irq_vector.patch
queue-4.4/x86-irq-remove-the-cpumask-allocation-from-send_cleanup_vector.patch
queue-4.4/x86-irq-fix-a-race-in-x86_vector_free_irqs.patch
queue-4.4/x86-irq-check-vector-allocation-early.patch
queue-4.4/irqchip-omap-intc-add-support-for-spurious-irq-handling.patch
queue-4.4/x86-irq-clear-move_in_progress-before-sending-cleanup-ipi.patch
queue-4.4/x86-mpx-fix-off-by-one-comparison-with-nr_registers.patch
queue-4.4/irqchip-atmel-aic-fix-wrong-bit-operation-for-irq-priority.patch
queue-4.4/revert-workqueue-make-sure-delayed-work-run-in-local-cpu.patch