lkml.org 
[lkml]   [2015]   [Oct]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[BUG] x86: apic: Possible null pointer dereference by apic_ack_edge
Date
Hello,

In mainline kernel version 4.3-rc4, the following line located in the
apic_ack_edge function definition can result in a null pointer dereference:

irq_complete_move(irqd_cfg(data));

The irqd_cfg function may return a value of NULL. If NULL is passed to the
irq_complete_move function, then the struct apic_chip_data pointer 'data' of
the __irq_complete_move function will be defined, and subsequently dereferenced,
based on this incorrect NULL value passed through the 'cfg' parameter:

data = container_of(cfg, struct apic_chip_data, cfg);
if (likely(!data->move_in_progress))

Sincerely,

William Breathitt Gray


\
 
 \ /
  Last update: 2015-10-10 23:21    [W:0.041 / U:0.296 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site