Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Jia-Ju Bai <baijiaju1990@gmail.com>
To:     Thomas Gleixner <tglx@linutronix.de>, mingo@redhat.com,
        hpa@zytor.com, mark.rutland@arm.com, swood@redhat.com,
        paulmck@linux.vnet.ibm.com
Cc:     x86@kernel.org, linux-kernel@vger.kernel.org
Subject: [BUG] x86: kernel: nmi: A possible sleep-in-atomic-context bug in
 nmi_handle()
Message-ID: <75833c57-d263-3b09-8306-62b4a3e371c8@gmail.com>
Date:   Fri, 10 Aug 2018 22:03:00 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.2.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

The code may sleep with holding a rcu read lock.

The function call paths (from bottom to top) in Linux-4.16 are:

========== BUG ==========
[FUNC] kmalloc(GFP_KERNEL)
arch/x86/mm/mmio-mod.c, 237: kmalloc in ioremap_trace_core
arch/x86/mm/mmio-mod.c, 289: ioremap_trace_core in mmiotrace_ioremap
arch/x86/mm/ioremap.c, 243: mmiotrace_ioremap in __ioremap_caller
arch/x86/mm/ioremap.c, 367: __ioremap_caller in ioremap_cache
./include/acpi/acpi_io.h, 13: ioremap_cache in acpi_os_ioremap
drivers/acpi/osl.c, 702: acpi_os_ioremap in acpi_os_read_memory
drivers/acpi/apei/apei-base.c, 662: acpi_os_read_memory in apei_read
drivers/acpi/apei/ghes.c, 335: apei_read in ghes_read_estatus
drivers/acpi/apei/ghes.c, 941: ghes_read_estatus in ghes_notify_nmi
arch/x86/kernel/nmi.c, 137: [FUNC_PTR]ghes_notify_nmi in nmi_handle
arch/x86/kernel/nmi.c, 124: rcu_read_lock in nmi_handle

Note that [FUNC_PTR] means a function pointer call is used.

I do not find a good way to fix it, so I only report.
These possible bugs are found by my static analysis tool (DSAC) and 
checked by my code review.


Best wishes,
Jia-Ju Bai