Null pointer dereference (call_timer_fn)

[Carlos Carvalho]

This crash seems similar to the one reported by brainatwork on Oct 22 for 4.7.9. We're running 4.7.10 with 201610262029. Here's the crash report (copied by hand from a photograph of the screen):

BUG: unable to handle kernel paging request at 0000000000000304
IP: [...] flush_unmaps_timeout+...
...
Call Trace:
<IRQ>
call_timer_fn.isra.4+...
intel_iommu_init_qi+...
run_timer_softirq+...
__do_soft_irq+...
irq_exit+...
smp_apic_timer_interrupt+...
apic_timer_interrupt+...
mwait_idle+...
cpu_startup_entry+...
start_secondary+...

This happened after several days of normal operation. I have no idea if it's related to PAX/GRSEC.