一次栈内数据释放后被引用，引起的kernel crash

一次栈内数据释放后被引用，引起的kernel crash

rootcause

sipa_hal_init 定义的struct cpumask cpu_mask; 地址为not mapped

@@ -840,6 +840,7 @@ struct sipa_plat_drv_cfg {

    struct hrtimer daemon_timer;

    u32 cpu_num;

    u32 cpu_num_ano;

+    struct cpumask cpu_mask;

int sipa_hal_init(struct device *dev)

{

    int i, ret;

-    struct cpumask cpu_mask;

    struct sipa_plat_drv_cfg *ipa = dev_get_drvdata(dev);

+    struct cpumask *cpu_mask = &ipa->cpu_mask;

-        memset(&cpu_mask, 0, sizeof(cpu_mask));

-        cpumask_set_cpu(i, &cpu_mask);

-        irq_set_affinity_hint(ipa->multi_intr[i], &cpu_mask);

+        memset(cpu_mask, 0, sizeof(struct cpumask));

+        cpumask_set_cpu(i, cpu_mask);

+        irq_set_affinity_hint(ipa->multi_intr[i], cpu_mask); 

crash 现场梳理过程

433.316204] sensor name: chg-thmzone

[ 433.321050] sensor name: board-thmzone

[ 433.325977] temp: 44357

[ 433.734907] Unable to handle kernel paging request at virtual address ffffff8010baba40

[ 433.745730] Mem abort info:

[ 433.748769] Exception class = DABT (current EL), IL = 32 bits

[ 433.754945] SET = 0, FnV = 0

[ 433.758237] EA = 0, S1PTW = 0

[ 433.761628] Data abort info:

[ 433.764766] ISV = 0, ISS = 0x00000007

[ 433.768852] CM = 0, WnR = 0

[ 433.772070] swapper pgtable: 4k pages, 39-bit VAs, pgd = 00000000650dbb38

[ 433.779106] [ffffff8010baba40] *pgd=000000037fffd003, *pud=000000037fffd003, *pmd=000000036d241003, *pte=0000000000000000

[ 433.790308] Internal error: Oops: 96000007 [#1] PREEMPT SMP

[ 433.796138] sprd-sysdump: dump_die_cb save pregs_die_g ok .

[ 433.801958] Modules linked in: flash_ic_ocp8137(O) flash_ic_sgm37891(O) npu_img_vha(O) npu_img_mem(O) sprd_sdio_fm(O) sprdbt_sdio_tty(O) ocp96011(O) st21nfc(O) omnivision_td4375_spi_ts(O) goodix_fp(O) mmdvfs(O) sprd_cpp(O) sprd_camera(O) sprd_flash_drv(O) sprd_sensor(O) wcn_bsp_sdio mali_kbase(O)

[ 433.828468] Process service 16 (pid: 9763, stack limit = 0x00000000aa33efff)

[ 433.835775] CPU: 1 PID: 9763 Comm: service 16 Tainted: G S W O 4.14.199 #1

[ 433.843681] Hardware name: