x86/ioapic: Prevent NULL pointer dereference in setup_ioapic_dest()

Werner Pawlitschko · KAGA-KOKO · commit ababae44108b · 2015-10-27T09:18:34.000+09:00
Commit 4857c91 changed the way how irq affinity is setup in setup_ioapic_dest() from using the core helper function to unconditionally calling the irq_set_affinity() callback of the underlying irq chip. That results in a NULL pointer dereference for the rare case where the underlying irq chip is lapic_chip which has no irq_set_affinity() callback. lapic_chip is occasionally used for the timer interrupt (irq 0). The fix is simple: Check the availability of the callback instead of calling it unconditionally. Fixes: 4857c91 "x86/ioapic: Force affinity setting in setup_ioapic_dest()" Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
@@ -2547,7 +2547,9 @@ void __init setup_ioapic_dest(void)
 			mask = apic->target_cpus();
 
 		chip = irq_data_get_irq_chip(idata);
-		chip->irq_set_affinity(idata, mask, false);
+		/* Might be lapic_chip for irq 0 */
+		if (chip->irq_set_affinity)
+			chip->irq_set_affinity(idata, mask, false);
 	}
 }
 #endif

Original file line number	Diff line number	Diff line change
`@@ -2547,7 +2547,9 @@ void __init setup_ioapic_dest(void)`
`2547`	`2547`	`mask = apic->target_cpus();`
`2548`	`2548`
`2549`	`2549`	`chip = irq_data_get_irq_chip(idata);`
`2550`		`- chip->irq_set_affinity(idata, mask, false);`
	`2550`	`+ /* Might be lapic_chip for irq 0 */`
	`2551`	`+ if (chip->irq_set_affinity)`
	`2552`	`+ chip->irq_set_affinity(idata, mask, false);`
`2551`	`2553`	`}`
`2552`	`2554`	`}`
`2553`	`2555`	`#endif`