Comment 0 for bug 1828394

Revision history for this message
bugproxy (bugproxy) wrote :

Description: qdio: clear intparm during shutdown
Symptom: Crash in qeth_irq() with "Unable to handle kernel pointer
               dereference in virtual kernel address space".
Problem: During shutdown, qdio returns its ccw device back to control
               by qeth - but doesn't reset the interrupt parameter on the
               device. If qdio_shutdown() failed to terminate its
               long-running IO on the ccw_device, qeth will subsequently
               do so. In this case the IRQ for the IO completion is
               presented to qeth_irq() with the _old_ interrupt parameter,
               which gets mis-interpreted as a valid qeth_cmd_buffer
               pointer. Dereferencing this bogus pointer in
               qeth_release_buffer() triggers the crash.
Solution: When returning the ccw device in qdio_shutdown(), also reset
               its interrupt parameter.
Reproduction: Offline an OSA CHPID with multiple active qeth interfaces.

Component: Kernel
Upstream-ID: 89286320a236d245834075fa13adb0bdd827ecaa

Reported: Ubuntu 18.04