On Tue, Jan 08, 2019 at 09:15:02AM -0500, Kyungtae Kim wrote: > On Tue, Jan 8, 2019 at 8:50 AM Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote: > > > > On Tue, Jan 08, 2019 at 08:37:37AM -0500, Kyungtae Kim wrote: > > > We report a bug in linux-4.20: "general protection fault in > > > spk_ttyio_ldisc_close" > > > > > > kernel config: https://kt0755.github.io/etc/config_v4.20_stable > > > repro: https://kt0755.github.io/etc/repro.a670e.c > > > > > > This occurs when the function kfree is about to execute > > > (driver/staging/speakup/spk_ttyio.c:68). > > > Particularly, kfree takes the argument like speakup_tty->disc_data. > > > But speakup_tty is invalid, so the pointer dereference causes GPF. > > > At a glance, it seems that speakup_tty was deallocated somewhere ahead of kfree. > > > > How did you trigger this? Did you shut down and close the device > > already somehow? Do you have a real tty device that is driven by the > > device? > > > > thanks, > > > > greg k-h > > For this crash, we did without real speakup tty device. How did you bind a non-real speakup tty device to the driver? > I'm currently trying to figure out how this actually happens. That would be great to figure out :) thanks, greg k-h _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
