mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 02:30:34 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

genirq: Prevent use-after-free and work list corruption

Browse source 
When irq_set_affinity_notifier() replaces the notifier, then the
reference count on the old notifier is dropped which causes it to be
freed. But nothing ensures that the old notifier is not longer queued
in the work list. If it is queued this results in a use after free and
possibly in work list corruption.

Ensure that the work is canceled before the reference is dropped.

Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: marc.zyngier@arm.com
Link: https://lkml.kernel.org/r/1553439424-6529-1-git-send-email-psodagud@codeaurora.org
This commit is contained in:
Prasad Sodagudi 2019-03-24 07:57:04 -07:00 committed by Thomas Gleixner
parent 8c2ffd9174
commit 59c39840f5
1 changed files with 3 additions and 1 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

4
kernel/irq/manage.c
View file

@ -357,8 +357,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify)
desc->affinity_notify = notify; desc->affinity_notify = notify;
raw_spin_unlock_irqrestore(&desc->lock, flags); raw_spin_unlock_irqrestore(&desc->lock, flags);
if (old_notify) if (old_notify) {
cancel_work_sync(&old_notify->work);
kref_put(&old_notify->kref, old_notify->release); kref_put(&old_notify->kref, old_notify->release);
}
return 0; return 0;
} }