From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751730AbbJJUyz (ORCPT ); Sat, 10 Oct 2015 16:54:55 -0400 Received: from mail-yk0-f169.google.com ([209.85.160.169]:33115 "EHLO mail-yk0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751391AbbJJUyx (ORCPT ); Sat, 10 Oct 2015 16:54:53 -0400 To: tglx@linutronix.de, mingo@redhat.com, hpa@zytor.com, jiang.liu@linux.intel.com Cc: x86@kernel.org, linux-kernel@vger.kernel.org From: William Breathitt Gray X-Enigmail-Draft-Status: N1010 Subject: [BUG] x86: apic: Possible null pointer dereference by apic_ack_edge Message-ID: <56197B1B.60304@gmail.com> Date: Sat, 10 Oct 2015 16:54:51 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, In mainline kernel version 4.3-rc4, the following line located in the apic_ack_edge function definition can result in a null pointer dereference: irq_complete_move(irqd_cfg(data)); The irqd_cfg function may return a value of NULL. If NULL is passed to the irq_complete_move function, then the struct apic_chip_data pointer 'data' of the __irq_complete_move function will be defined, and subsequently dereferenced, based on this incorrect NULL value passed through the 'cfg' parameter: data = container_of(cfg, struct apic_chip_data, cfg); if (likely(!data->move_in_progress)) Sincerely, William Breathitt Gray