pinpointed: PANIC caused by dequeue_signal() in current Linus

[Anton Altaparmakov]

Hi,

I had a look and the panic actually happens in collect_signal() in here:

static inline int collect_signal(int sig, struct sigpending *list, 
siginfo_t *info)
{
         if (sigismember(&list->signal, sig)) {
                 /* Collect the siginfo appropriate to this signal.  */
                 struct sigqueue *q, **pp;
                 pp = &list->head;
                 while ((q = *pp) != NULL) {
q becomes 0x5a5a5a5a  ^^^^^^^^^
                         if (q->info.si_signo == sig)
0x5a5a5a5a is dereferenced ^^^^^^^^^^^^^^^^
                                 goto found_it;
                         pp = &q->next;
                 }

Hope this helps.

Best regards,

         Anton